Skip to content

Fixed query for functionality - #2343

Closed
TheLawsOfChaos wants to merge 1 commit into
splunk:developfrom
TheLawsOfChaos:patch-1
Closed

TheLawsOfChaos wants to merge 1 commit into
splunk:developfrom
TheLawsOfChaos:patch-1

Conversation

@TheLawsOfChaos

@TheLawsOfChaos TheLawsOfChaos commented Aug 29, 2022 •

Copy link
Copy Markdown
Contributor

Processes.process=* rd * will never work, so modified it to be Processes.process="* rd *"

Details

_What does this PR have in it?
Literally added in two sets of double quotes to ensure the field=value works.

Checklist

  • Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
  • CI/CD jobs passed ✔️
  • Validated SPL logic.
  • Validated tags, description, and how to implement.
  • Verified references match analytic.

`Processes.process=* rd *` will never work, so modified it to be Processes.process="* rd *"
@auto-assign
auto-assign Bot requested a review from josehelps August 29, 2022 15:40
@patel-bhavin

Copy link
Copy Markdown
Contributor

Hello @TheLawsOfChaos : the current CI workflow related to detection-testing is not working for PRs from forks. In order to get the SPLs tested, i will create one single PR with all your PRs and run its via testing. Will keep you posted when the new PR is ready. Thanks for the updates 👍

@patel-bhavin

Copy link
Copy Markdown
Contributor

adding this update to #2366

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants