Terrance DeJesus deab1c0161 [Rule Tuning] Change event.dataset to data_stream.dataset (#5943) ...

* [Rule Tuning] Change event.dataset to data_stream.dataset

* updating ESQL field names

2026-04-10 12:27:52 -04:00

..

privilege_escalation_cyberarkpas_error_audit_event_promotion.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

privilege_escalation_cyberarkpas_recommended_events_to_monitor_promotion.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00