prevent EventID collision for dhcp

This prevents EventID collision for this rule with other sources/logs that share the same EventIDs. specifically a lot with Microsoft-Windows-Security-SPP
2019-07-16 15:30:52 -04:00
parent b20b42b9c9
commit e2050404bc
1 changed files with 1 additions and 0 deletions
@@ -19,6 +19,7 @@ detection:
            - 1031
            - 1032
            - 1034
+        Source: Microsoft-Windows-DHCP-Server            
    condition: selection
 falsepositives: 
    - Unknown