adding baseline key to test

Author: patel-bhavin

baselines/baseline_of_open_s3_bucket_decommissioning.yml

@@ -61,11 +61,4 @@ deployment:
     cron_schedule: 0 2 * * 0
     earliest_time: -30d@d
     latest_time: -1d@d
-    schedule_window: auto
-# Baselines usually dont have tests, but there was no good place to store this information explicitly, adding it as a comment.
-# tests:
-# - name: Baseline Dataset Test
-#   attack_data:
-#   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/decommissioned_buckets/cloudtrail.json
-#     source: cloudtrail
-#     sourcetype: aws:cloudtrail
+    schedule_window: auto

detections/network/detect_dns_query_to_decommissioned_s3_bucket.yml

@@ -49,6 +49,11 @@ tags:
   security_domain: network
   manual_test: This search needs a lookup table to be populated -decommissioned_buckets.csv by running a baseline search `Baseline Of Open S3 Bucket Decommissioning` prior to running this detection.
 tests:
+- name: Baseline Dataset Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/decommissioned_buckets/cloudtrail.json
+    source: cloudtrail
+    sourcetype: aws:cloudtrail
 - name: True Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/decommissioned_buckets/dns.log

detections/web/detect_web_access_to_decommissioned_s3_bucket.yml

@@ -51,8 +51,13 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   security_domain: network
-  manual_test: This search needs a lookup table to be populated -decommissioned_buckets.csv by running a baseline search `Baseline Of Open S3 Bucket Decommissioning` prior to running this detection.
+  manual_test: This search needs a lookup table to be populated - decommissioned_buckets.csv by running a baseline search `Baseline Of Open S3 Bucket Decommissioning` prior to running this detection.
 tests:
+- name: Baseline Dataset Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/decommissioned_buckets/cloudtrail.json
+    source: cloudtrail
+    sourcetype: aws:cloudtrail
 - name: True Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/decommissioned_buckets/web_cloudfront_access.log