From 36e5e48d62bb120d261b32c26b87fee055827405 Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Wed, 18 Dec 2024 15:28:51 +0000 Subject: [PATCH] Update rules/integrations/endpoint/impact_elastic_ransomware_detected.toml Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> --- .../endpoint/impact_elastic_ransomware_detected.toml | 1 - 1 file changed, 1 deletion(-) diff --git a/rules/integrations/endpoint/impact_elastic_ransomware_detected.toml b/rules/integrations/endpoint/impact_elastic_ransomware_detected.toml index 232712ecbf8..42007f122e3 100644 --- a/rules/integrations/endpoint/impact_elastic_ransomware_detected.toml +++ b/rules/integrations/endpoint/impact_elastic_ransomware_detected.toml @@ -40,7 +40,6 @@ Generally, our ransomware protection is tuned to have extremely low false positi - Quickly identifying the compromised credentials is critical to remediate Ransomware attacks. - Verify if there are any other alert types (Behavior or Memory Threat) associated with the same host or user or process within the same time. - ### False positive analysis - Installers and backup software, which can make a large number of modifications to documents (especially during a restore operation).