Add min_stack and indexes back (#1648)

(cherry picked from commit c21337fe4f)
This commit is contained in:
Jonhnathan
2021-12-07 10:00:58 -03:00
committed by github-actions[bot]
parent 396cee32f1
commit f37235581c
@@ -2,6 +2,8 @@
creation_date = "2021/07/30"
maturity = "production"
updated_date = "2021/12/06"
min_stack_comments = "EQL regex had a bug when dealing with wildcard fields that was fixed in 7.16"
min_stack_version = "7.16.0"
[rule]
author = ["Elastic"]
@@ -12,7 +14,7 @@ their malicious command with unnecessary whitespace characters. These observatio
behavior.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"]
language = "eql"
license = "Elastic License v2"
name = "Whitespace Padding in Process Command Line"