Update multiple_alerts_different_tactics_host.toml (#4854)

This commit is contained in:
Samirbous
2025-06-27 13:53:42 +01:00
committed by GitHub
parent 7c07033354
commit 09b928fb84
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2022/11/16"
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/06/27"
[rule]
author = ["Elastic"]
@@ -70,7 +70,7 @@ The detection rule identifies hosts with alerts across various attack phases, in
[rule.threshold]
field = ["host.id"]
field = ["host.id", "host.name"]
value = 1
[[rule.threshold.cardinality]]
field = "kibana.alert.rule.threat.tactic.id"