Update telegram_detected_access_suspicious_api_url.yml

fix drilldown and change index to macros `wineventlog_security`

Author: zake1god

detections/endpoint/telegram_detected_access_suspicious_api_url.yml

@@ -8,7 +8,7 @@ author: Zaki Zarkasih Al Mustafa
 type: TTP
 status: production
 description: Detects suspicious process activity related to Telegram API
-search: index=windows (sourcetype=Wineventlog:Security OR source=Wineventlog:Security)
+search: `wineventlog_security`
   AND ParentProcessName=*Telegram* AND CommandLine=*api.telegram* | eval utc_time=strptime(TimeCreated,
   "%Y-%m-%dT%H:%M:%S.%6NZ") | eval Time_Created=strftime(utc_time + 25200, "%Y-%m-%d
   %H:%M:%S") | rename Time_Created as "Time Created", host as Host, src_user as User
@@ -28,33 +28,27 @@ known_false_positives: |
   Developers testing Telegram API functionality in controlled environments.
 
 drilldown_searches:
-  - name: Original Detection
-    description: Original detection search results
-    search: "%original_detection_search%"
-    earliest_offset: -24h
-    latest_offset: now
-  
   - name: Investigate Parent Process
     description: |
       This drilldown searches for other processes spawned by the same parent process
       to identify potential patterns or related activities.
     search: |
-      index=windows (sourcetype=Wineventlog:Security OR source=Wineventlog:Security)
+      `wineventlog_security`
       AND ParentProcessName="$ParentProcessName$"
       | table _time, ParentProcessName, NewProcessName, CommandLine
-    earliest_offset: -24h
-    latest_offset: now
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
 
   - name: Investigate User Activity
     description: |
       This drilldown searches for all activities performed by the same user in the
       Windows Event Logs to provide additional context.
     search: |
-      index=windows (sourcetype=Wineventlog:Security OR source=Wineventlog:Security)
+      `wineventlog_security`
       AND src_user="$src_user$"
       | table _time, src_user, EventID, host, CommandLine
-    earliest_offset: -24h
-    latest_offset: now
+    earliest_offset: $info_min_time$
+    latest_offset: $info_max_time$
 
 references:
 - https://securelist.com/telegram-phishing-services/109383/
@@ -97,4 +91,4 @@ tests:
   attack_data:
   - data: https://github.com/splunk/contentctl/wiki
     sourcetype: Wineventlog:Security
-    source: Wineventlog
+    source: Wineventlog