security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Change interval and lookback time for IM rule (#1596)

Browse Source 
(cherry picked from commit f47b0f61cc)
This commit is contained in:
Khristinin Nikita
2021-11-01 09:27:38 +01:00
committed by github-actions[bot]
parent 365c2a73f2
commit 2c197b57fb
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/cross-platform/threat_intel_module_match.toml
+3 -3
View File
@@ -1,16 +1,16 @@
[metadata]
creation_date = "2021/04/21"
maturity = "production"
updated_date = "2021/09/13"
updated_date = "2021/10/29"
[rule]
author = ["Elastic"]
description = """
This rule is triggered when indicators from the Threat Intel Filebeat module has a match against local file or network observations.
"""
from = "now-10m"
from = "now-65m"
index = ["auditbeat-*", "endgame-*", "filebeat-*", "logs-*", "packetbeat-*", "winlogbeat-*"]
interval = "9m"
interval = "1h"
language = "kuery"
license = "Elastic License v2"
name = "Threat Intel Filebeat Module Indicator Match"