[Rule Tuning] 7.11.2: Add timestamp_override to all query and non-sequence EQL rules (#948)

* [Rule Tuning] Add timestamp_override field to 7.11.0 rules
* Lock versions for 7.11.2 rules

rules/windows/initial_access_script_executing_powershell.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/02/18"
 maturity = "production"
-updated_date = "2020/12/17"
+updated_date = "2020/02/16"
 
 [rule]
 author = ["Elastic"]
@@ -18,6 +18,7 @@ risk_score = 21
 rule_id = "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc"
 severity = "low"
 tags = ["Elastic", "Host", "Windows", "Threat Detection", "Execution"]
+timestamp_override = "event.ingested"
 type = "query"
 
 query = '''
@@ -37,6 +38,7 @@ name = "Spearphishing Attachment"
 reference = "https://attack.mitre.org/techniques/T1566/001/"
 
 
+
 [rule.threat.tactic]
 id = "TA0001"
 name = "Initial Access"