[Rule Tuning] 7.11.2: Add timestamp_override to all query and non-sequence EQL rules (#948)
* [Rule Tuning] Add timestamp_override field to 7.11.0 rules * Lock versions for 7.11.2 rules
This commit is contained in:
@@ -1,7 +1,7 @@
|
||||
[metadata]
|
||||
creation_date = "2020/04/15"
|
||||
maturity = "production"
|
||||
updated_date = "2020/11/03"
|
||||
updated_date = "2020/02/16"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -18,6 +18,7 @@ risk_score = 73
|
||||
rule_id = "d76b02ef-fc95-4001-9297-01cb7412232f"
|
||||
severity = "high"
|
||||
tags = ["Elastic", "Host", "Linux", "Threat Detection", "Execution"]
|
||||
timestamp_override = "event.ingested"
|
||||
type = "query"
|
||||
|
||||
query = '''
|
||||
|
||||
Reference in New Issue
Block a user