Lower polling time to once a minute

2022-10-17 17:30:41 -04:00 · 2022-10-17 17:30:41 -04:00 · 5c7ec52350
parent de51dcdfcb
commit 5c7ec52350
1 changed files with 2 additions and 2 deletions
--- a/detection/execution/exotic-command-events-linux.sql
+++ b/detection/execution/exotic-command-events-linux.sql
@ -5,7 +5,7 @@
 --
 -- tags: transient process events
 -- platform: linux
-- interval: 15
+-- interval: 60
 SELECT
  p.pid,
  p.path,
@ -34,7 +34,7 @@ FROM
  LEFT JOIN hash ON p.path = hash.path
  LEFT JOIN hash AS phash ON pp.path = hash.path
 WHERE
-  p.time > (strftime('%s', 'now') -15)
+  p.time > (strftime('%s', 'now') -60)
  AND (
    basename IN (
      'bitspin',