Correct "Could not load lookup=LOOKUP-eventcode" issue

olafhartong / ThreatHunting

A Splunk app mapped to MITRE ATT&CK to guide your threat hunts

MIT License

1.12k stars 177 forks source link

Closed ZikyHD closed 4 years ago

ZikyHD commented 4 years ago

Change to use a global index macro (seems to be easier to set)
Remove eventcode lookup causing error on search (using TA Microsoft Sysmon lookup instead)

olafhartong commented 4 years ago

Thanks for this @ZikyHD !