Update External Alerts rule index to match default securitySolution:defaultIndex value (#86)
## Summary Updates the External Alerts rule index to match default securitySolution:defaultIndex value ``` toml index = ["apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", "logs-*", "packetbeat-*", "winlogbeat-*"] ``` Note: extra spaces are from running `toml-lint` ## Contributor checklist - Have you signed the [contributor license agreement](https://www.elastic.co/contributor-agreement)? Yes! - Have you followed the [contributor guidelines](https://github.com/elastic/detection-rules/blob/main/CONTRIBUTING.md)? Yes!
This commit is contained in:
@@ -7,9 +7,10 @@ updated_date = "2020/07/08"
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
description = """
|
||||
Generates a detection alert for each external alert written to the configured securitySolution:defaultIndex. Enabling
|
||||
Generates a detection alert for each external alert written to the configured indices. Enabling
|
||||
this rule allows you to immediately begin investigating external alerts in the app.
|
||||
"""
|
||||
index = ["apm-*-transaction*", "auditbeat-*", "endgame-*", "filebeat-*", "logs-*", "packetbeat-*", "winlogbeat-*"]
|
||||
language = "kuery"
|
||||
license = "Elastic License"
|
||||
max_signals = 10000
|
||||
@@ -55,3 +56,4 @@ field = "event.severity"
|
||||
operator = "equals"
|
||||
value = "99"
|
||||
severity = "critical"
|
||||
|
||||
|
||||
Reference in New Issue
Block a user