Skip to content

Commit

Permalink
added note on the volume of actions for rules
Browse files Browse the repository at this point in the history
  • Loading branch information
@asjadathick
asjadathick committed Jun 23, 2020
1 parent 494dc31 commit 428c5c7
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions Security Analytics/ACSC2020-008_IOCs/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,4 +13,6 @@ IOCs often change rapidly during campaigns and should not solely be relied upon
* Review the field names used within the rules. The rules currently reference default ECS fields, but your field names may vary internally
* Activate rules as required

Note that the SIEM rules currently run every 60 minutes, looking back at events from the last 60 minutes. The rules currently do not run actions for every execution. If you need to act on detections, it would be a good idea to set the frequency to `Hourly` rather than on each rule execution, to reduce the amount of noise created.

[Here is a full blog post](https/elastic.co/blog) on the campaign and Elastic Security.

0 comments on commit 428c5c7

Please sign in to comment.