From a564af2dfd228eeb2db8b8f60e26799aedcfc96a Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 16 Jun 2026 22:25:31 +0530 Subject: [PATCH] udpating risk_message --- .../endpoint/windows_suspicious_burst_of_password_changes.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_suspicious_burst_of_password_changes.yml b/detections/endpoint/windows_suspicious_burst_of_password_changes.yml index 84fc995ac6a..b0d3a2986e5 100644 --- a/detections/endpoint/windows_suspicious_burst_of_password_changes.yml +++ b/detections/endpoint/windows_suspicious_burst_of_password_changes.yml @@ -62,7 +62,7 @@ drilldown_searches: name: View risk events for the last 7 days for - "$user$" and "$dest$" search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' finding: - title: Rapid burst of password changes of local accounts by $SubjectUserName$ on $dest$ + title: Rapid burst of password changes of local accounts by $InitiatingAccounts$ on $dest$ entity: field: dest type: system