Br3akp0int

icon location malware/security researcher and forensic

Results 3 comments of Br3akp0int

Fields missing from joined tstats

fix is in PR https://github.com/splunk/security_content/pull/2298

auditd_sourcetype_update

> Updated the sourcetype, version and date of all detections to auditd. However, can you check @tccontre is we still need those `linux_auditd_normalized*` macros in the searches ! noted. agree...

auditd_sourcetype_update

will close this one since most of the detections that uses PROCTILE and EXECVE needs a new attackdata and updated detection searches. https://github.com/splunk/security_content/pull/3352