Update multiple_alerts_different_tactics_host.toml (#4854)
This commit is contained in:
@@ -1,7 +1,7 @@
|
||||
[metadata]
|
||||
creation_date = "2022/11/16"
|
||||
maturity = "production"
|
||||
updated_date = "2025/01/15"
|
||||
updated_date = "2025/06/27"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -70,7 +70,7 @@ The detection rule identifies hosts with alerts across various attack phases, in
|
||||
|
||||
|
||||
[rule.threshold]
|
||||
field = ["host.id"]
|
||||
field = ["host.id", "host.name"]
|
||||
value = 1
|
||||
[[rule.threshold.cardinality]]
|
||||
field = "kibana.alert.rule.threat.tactic.id"
|
||||
|
||||
Reference in New Issue
Block a user