Add min_stack and indexes back (#1648)
(cherry picked from commit c21337fe4f)
This commit is contained in:
committed by
github-actions[bot]
parent
396cee32f1
commit
f37235581c
@@ -2,6 +2,8 @@
|
||||
creation_date = "2021/07/30"
|
||||
maturity = "production"
|
||||
updated_date = "2021/12/06"
|
||||
min_stack_comments = "EQL regex had a bug when dealing with wildcard fields that was fixed in 7.16"
|
||||
min_stack_version = "7.16.0"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -12,7 +14,7 @@ their malicious command with unnecessary whitespace characters. These observatio
|
||||
behavior.
|
||||
"""
|
||||
from = "now-9m"
|
||||
index = ["logs-endpoint.events.*"]
|
||||
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Whitespace Padding in Process Command Line"
|
||||
|
||||
Reference in New Issue
Block a user