lookup_rare_process_allow_list_local.yml

name: lookup_rare_process_allow_list_local
date: 2024-12-23
version: 2
id: 7aec9c17-69b8-4a0b-8f8d-d3ea9b0e2adb
author: Splunk Threat Research Team
lookup_type: csv
case_sensitive_match: false
default_match: false
description: A list of rare processes that are legitimate provided by the end user
match_type: 
- WILDCARD(process)
min_matches: 1