add extra tag to high_disk_bytes_read.sql

Signed-off-by: Dave Smith <dave.smith@chainguard.dev>
2024-10-25 14:17:32 -04:00 · 2024-10-25 14:17:32 -04:00 · 0c10622a50
parent 7fad85ceeb
commit 0c10622a50
1 changed files with 1 additions and 1 deletions
--- a/detection/exfil/high_disk_bytes_read.sql
+++ b/detection/exfil/high_disk_bytes_read.sql
@ -10,7 +10,7 @@
 -- references:
 --   * https://attack.mitre.org/tactics/TA0010/ (Exfiltration)
 --
-- tags: transient process
+-- tags: transient process extra
 SELECT
  -- WARNING: Writes to tmpfs are not reflected against this counter
  p0.disk_bytes_read AS bytes_read,