Skip to content

Commit 6a561d6

Browse files
committed
updating macro
1 parent 23944ac commit 6a561d6

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

detections/network/cisco_smart_install_oversized_packet_detection.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ search: |
2323
| `drop_dm_object_name("All_Traffic")`
2424
| where max_bytes > 500
2525
| eval severity=case(max_bytes>1400, "critical", max_bytes>1000, "high", 1=1, "medium")
26-
| `cisco_smart_install_oversized_message_detection_filter`
26+
| `cisco_smart_install_oversized_packet_detection_filter`
2727
how_to_implement: |
2828
To implement this search, ingest network traffic into the Network_Traffic data model (e.g., via Splunk Stream with
2929
sourcetype "stream:tcp"). The search analyzes TCP traffic to destination port 4786 (Cisco Smart Install) over hourly

0 commit comments

Comments
 (0)