[Rule Tuning] Update Index Pattern for Detection Engine Rules (#101)
* [Rule Tuning] Update Index Pattern for Detection Engine Rules * update indices
This commit is contained in:
@@ -2,7 +2,7 @@
|
||||
creation_date = "2020/04/15"
|
||||
ecs_version = ["1.5.0"]
|
||||
maturity = "production"
|
||||
updated_date = "2020/06/25"
|
||||
updated_date = "2020/08/03"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -10,7 +10,7 @@ description = """
|
||||
Identifies when a terminal (tty) is spawned via Python. Attackers may upgrade a simple reverse shell to a fully
|
||||
interactive tty after obtaining initial access to a host.
|
||||
"""
|
||||
index = ["auditbeat-*"]
|
||||
index = ["auditbeat-*", "logs-endpoint.events.*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License"
|
||||
name = "Interactive Terminal Spawned via Python"
|
||||
|
||||
Reference in New Issue
Block a user