[Rule Tuning] Tighten Up Elastic Defend Indexes - Linux (#4446)

rules/linux/execution_remote_code_execution_via_postgresql.toml

@@ -2,7 +2,7 @@
 creation_date = "2022/06/20"
 integration = ["endpoint"]
 maturity = "production"
-updated_date = "2025/01/24"
+updated_date = "2025/02/04"
 
 [rule]
 author = ["Elastic"]
@@ -14,7 +14,7 @@ which can result in unauthorized access and malicious actions, and facilitate po
 unauthorized access and malicious actions.
 """
 from = "now-9m"
-index = ["logs-endpoint.events.*", "endgame-*"]
+index = ["endgame-*", "logs-endpoint.events.process*"]
 language = "eql"
 license = "Elastic License v2"
 name = "Potential Code Execution via Postgresql"