Merge pull request #3289 from splunk/extra_fields

Removed Observables section from last two stragglers
splunk · Jan 22, 2025 · bd168ee · bd168ee
2 parents 8431eae + a10fa00
commit bd168ee
Show file tree

Hide file tree

Showing 2 changed files with 0 additions and 14 deletions.
diff --git a/detections/endpoint/windows_bitlockertogo_process_execution.yml b/detections/endpoint/windows_bitlockertogo_process_execution.yml
@@ -42,15 +42,6 @@ tags:
   asset_type: Endpoint
   mitre_attack_id:
   - T1218
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: user
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

diff --git a/detections/endpoint/windows_bitlockertogo_with_network_activity.yml b/detections/endpoint/windows_bitlockertogo_with_network_activity.yml
@@ -38,11 +38,6 @@ tags:
   asset_type: Endpoint
   mitre_attack_id:
   - T1218
-  observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security