Closed billmurrin closed 2 years ago
Hi Bill, not a bad idea, I can imagine some companies have a strict naming convention. If you don't mind please go ahead a file a pull request.
I am a bit stretched for time to coming weeks
I can grab this and work n it throughout this week.
Olaf,
Our team uses a custom name for the
threathunting
index. With that in mind, we realized how you used thesysmon
macro and thought it might a great idea if you also included athreathunting
macro to help define thethreathunting
summary index. If you like that idea, I don't mind helping out doing some of the lifting to make that work.