Add filebeat-* index pattern to rules based on system.auth dataset (#3561)

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> (cherry picked from commit 153657029b)
2024-04-03 11:27:31 +02:00
parent fe9217892f
commit a6ea41cae0
5 changed files with 5 additions and 5 deletions
@@ -29,7 +29,7 @@ description = """
 Identifies attempts to create a new group. Attackers may create new groups to establish persistence on a system.
 """
 from = "now-9m"
-index = ["logs-system.auth-*"]
+index = ["filebeat-*", "logs-system.auth-*"]
 language = "eql"
 license = "Elastic License v2"
 name = "Linux Group Creation"