security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

Browse Source 
* [Rule Tuning] Change event.dataset to data_stream.dataset

* updating ESQL field names
This commit is contained in:
Terrance DeJesus
2026-04-10 12:27:52 -04:00
committed by GitHub
parent 9736407ef3
commit deab1c0161
472 changed files with 1022 additions and 1022 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/execution_executable_stack_execution.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/01/07"
integration = ["system"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/10"
[rule]
author = ["Elastic"]
@@ -50,7 +50,7 @@ tags = [
timestamp_override = "event.ingested"
type = "query"
query = '''
host.os.type:"linux" and event.dataset:"system.syslog" and process.name:"kernel" and
host.os.type:"linux" and data_stream.dataset:"system.syslog" and process.name:"kernel" and
message:"started with executable stack"
'''
note = """## Triage and analysis