EQL with time filter

Elastic Stack Elasticsearch
1

Hello!

I use rule for checking Sysmon logs

'''any where event.code == 1 and process.executable: "C:\Windows\System32\sc.exe" '''

The rule is working, but it checks all existing indexes.
And my ELK is very loaded. How can I create a time filter for this rule?

Снимок экрана 2022-10-17 в 15.22.20
Снимок экрана 2022-10-17 в 15.22.202050×426 28.7 KB

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.