diff --git a/.github/workflows/replay-datasets.yml b/.github/workflows/replay-datasets.yml index ea575308..e3ab77aa 100644 --- a/.github/workflows/replay-datasets.yml +++ b/.github/workflows/replay-datasets.yml @@ -2,11 +2,7 @@ name: Replay Changed Datasets to Splunk on: push: - branches: [ main, master ] - paths: - - 'datasets/**' - pull_request: - branches: [ main, master ] + branches: [ master ] paths: - 'datasets/**' workflow_dispatch: @@ -26,6 +22,9 @@ jobs: with: fetch-depth: 0 # Fetch full history for file change detection + - name: Pull Git LFS files + run: git lfs pull + - name: Set up Python uses: actions/setup-python@v4 with: diff --git a/datasets/attack_techniques/T1556/disable_lsa_protection_new/disable_lsa_protection_new.yml b/datasets/attack_techniques/T1556/disable_lsa_protection_new/disable_lsa_protection_new.yml index 847d3678..673414eb 100644 --- a/datasets/attack_techniques/T1556/disable_lsa_protection_new/disable_lsa_protection_new.yml +++ b/datasets/attack_techniques/T1556/disable_lsa_protection_new/disable_lsa_protection_new.yml @@ -10,4 +10,5 @@ datasets: - name: lsa_reg_deletion_modification.log path: /datasets/attack_techniques/T1556/disable_lsa_protection_new/lsa_reg_deletion_modification.log sourcetype: 'XmlWinEventLog' - source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational' \ No newline at end of file + source: 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational' +