From 09b928fb84dac8402ad0a13bd1ebee4aa4cd461e Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Fri, 27 Jun 2025 13:53:42 +0100
Subject: [PATCH] Update multiple_alerts_different_tactics_host.toml (#4854)

---
 .../multiple_alerts_different_tactics_host.toml               | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rules/cross-platform/multiple_alerts_different_tactics_host.toml b/rules/cross-platform/multiple_alerts_different_tactics_host.toml
index cdb625143..363e8695b 100644
--- a/rules/cross-platform/multiple_alerts_different_tactics_host.toml
+++ b/rules/cross-platform/multiple_alerts_different_tactics_host.toml
@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2022/11/16"
 maturity = "production"
-updated_date = "2025/01/15"
+updated_date = "2025/06/27"
 
 [rule]
 author = ["Elastic"]
@@ -70,7 +70,7 @@ The detection rule identifies hosts with alerts across various attack phases, in
 
 
 [rule.threshold]
-field = ["host.id"]
+field = ["host.id", "host.name"]
 value = 1
 [[rule.threshold.cardinality]]
 field = "kibana.alert.rule.threat.tactic.id"