From 0f8c10fad390a51b87e047094367508a22718d32 Mon Sep 17 00:00:00 2001
From: taylor_socfortress <111797488+taylorwalton@users.noreply.github.com>
Date: Tue, 7 Mar 2023 08:03:04 -0600
Subject: [PATCH] Update and rename 91570-win_logonsessions_rules.xml to
 100070-win_logonsessions_rules.xml

---
 ...gonsessions_rules.xml => 100070-win_logonsessions_rules.xml} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename Windows Logon Sessions/{91570-win_logonsessions_rules.xml => 100070-win_logonsessions_rules.xml} (91%)

diff --git a/Windows Logon Sessions/91570-win_logonsessions_rules.xml b/Windows Logon Sessions/100070-win_logonsessions_rules.xml
similarity index 91%
rename from Windows Logon Sessions/91570-win_logonsessions_rules.xml
rename to Windows Logon Sessions/100070-win_logonsessions_rules.xml
index f73733e..0f6ef9e 100644
--- a/Windows Logon Sessions/91570-win_logonsessions_rules.xml	
+++ b/Windows Logon Sessions/100070-win_logonsessions_rules.xml	
@@ -1,5 +1,5 @@
 <group name="windows,">
-<rule id="91570" level="3">
+<rule id="100070" level="3">
   <decoded_as>json</decoded_as>
   <field name="LogonSession">\.+</field>
   <field name="UserName">\.+</field>