security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

Browse Source 
* [Rule Tuning] Change event.dataset to data_stream.dataset

* updating ESQL field names
This commit is contained in:
Terrance DeJesus
2026-04-10 12:27:52 -04:00
committed by GitHub
parent 9736407ef3
commit deab1c0161
472 changed files with 1022 additions and 1022 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/github/execution_github_app_deleted.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2023/10/11"
integration = ["github"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/10"
[rule]
author = ["Elastic"]
@@ -61,7 +61,7 @@ timestamp_override = "event.ingested"
type = "eql"
query = '''
configuration where event.dataset == "github.audit" and github.category == "integration_installation" and event.type == "deletion"
configuration where data_stream.dataset == "github.audit" and github.category == "integration_installation" and event.type == "deletion"
'''