Increase lookback for endpoint rules (#200)

2020-08-21 12:23:43 -05:00
parent 69a5b7e409
commit be08536880
75 changed files with 81 additions and 0 deletions
@@ -10,6 +10,7 @@ description = """
 Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes
 executing a PowerShell script, may be indicative of malicious activity.
 """
+from = "now-9m"
 index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"