security_content
security_content copied to clipboard
[BUG] Detect Outbound LDAP Traffic, missing dm summary macro
Describe the bug
The search for "Detect Outbound LDAP Traffic" is missing the macro security_content_summariesonly causing the search to always run without using the dm summary.
https://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml
Expected behavior
The search should reference the macro to behave the same as other tstats searches in ESCU.
Maybe some check for tstats + security_content_summariesonly should be implemented?
Thank you for opening this. Here is a PR with the pointed fix, but we will do a review to see if we have other content missing this macro as well and consider whether this should be a check in contentctl: https://github.com/splunk/security_content/pull/3168
Since this PR is not merged yet, I will leave this issue open until the issue is resolved.
@DipsyTipsy : thank you for raising the issue. The fix has been merged and we will release this update in 4.43.0!