Update PaloAltoPrismaCloudMultipleFailedLoginsUser.yaml
Fix threshold typo
This commit is contained in:
Родитель
5fe1ffd832
Коммит
abc32f3b7a
|
@ -16,13 +16,13 @@ tactics:
|
|||
relevantTechniques:
|
||||
- T1110
|
||||
query: |
|
||||
let threashold = 10;
|
||||
let threshold = 10;
|
||||
PaloAltoPrismaCloud
|
||||
| where ResourceType =~ 'Login'
|
||||
| where EventResult =~ 'Failed'
|
||||
| where EventMessage !has 'access key'
|
||||
| summarize count() by UserName, bin(TimeGenerated, 5m)
|
||||
| where count_ > threashold
|
||||
| where count_ > threshold
|
||||
| extend AccountCustomEntity = UserName
|
||||
entityMappings:
|
||||
- entityType: Account
|
||||
|
|
Загрузка…
Ссылка в новой задаче