Terrance DeJesus deab1c0161 [Rule Tuning] Change event.dataset to data_stream.dataset (#5943) ...

* [Rule Tuning] Change event.dataset to data_stream.dataset

* updating ESQL field names

2026-04-10 12:27:52 -04:00

..

defense_evasion_github_protected_branch_settings_changed.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

defense_evasion_secret_scanning_disabled.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

execution_github_app_deleted.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

execution_github_high_number_of_cloned_repos_from_pat.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

execution_github_ueba_multiple_behavior_alerts_from_account.toml

Prep for Release 9.0 (#4550)

2025-03-20 20:32:07 +05:30

execution_new_github_app_installed.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

exfiltration_github_private_repository_turned_public.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

exfiltration_high_number_of_cloning_by_user.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

impact_github_repository_activity_from_unusual_ip.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

impact_github_repository_deleted.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

impact_high_number_of_closed_pull_requests_by_user.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

impact_high_number_of_failed_protected_branch_force_pushes_by_user.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

impact_high_number_of_protected_branch_force_pushes_by_user.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

initial_access_github_actions_bot_first_push_to_repo.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

initial_access_github_actions_workflow_injection_blocked.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 09:12:42 -05:00

initial_access_github_register_self_hosted_runner.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

persistence_github_org_owner_added.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

persistence_new_pat_created.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

persistence_organization_owner_role_granted.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00