Fix Dedup Period for Crowdstrike.Detection.passthrough (panther-labs#…

…1445)
bcpenta · Dec 9, 2024 · 8e38626 · 8e38626
1 parent f8f7890
commit 8e38626
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/crowdstrike_rules/crowdstrike_detection_passthrough.yml b/rules/crowdstrike_rules/crowdstrike_detection_passthrough.yml
@@ -12,7 +12,7 @@ Tags:
 Description: Crowdstrike Falcon has detected malicious activity on a host.
 Runbook: Follow the Falcon console link and follow the IR process as needed.
 Reference: https://www.crowdstrike.com/blog/tech-center/hunt-threat-activity-falcon-endpoint-protection/
-DedupPeriodMinutes: 0
+DedupPeriodMinutes: 60
 SummaryAttributes:
   - p_any_ip_addresses
 Tests: