Increase lookback for endpoint rules (#200)

2020-08-21 12:23:43 -05:00
parent 69a5b7e409
commit be08536880
75 changed files with 81 additions and 0 deletions
@@ -10,6 +10,7 @@ description = """
 Identifies when a terminal (tty) is spawned via Python. Attackers may upgrade a simple reverse shell to a fully
 interactive tty after obtaining initial access to a host.
 """
+from = "now-9m"
 index = ["auditbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"