Update credential_access_multi_could_secrets_via_api.toml

Samirbous · Samirbous · commit 4a8a5dce2634 · 2025-12-01T16:38:59.000Z
diff --git a/rules/cross-platform/credential_access_multi_could_secrets_via_api.toml b/rules/cross-platform/credential_access_multi_could_secrets_via_api.toml
@@ -137,6 +137,7 @@ FROM logs-* metadata _id, _version, _index
     Esql.users = VALUES(user.name)
   BY source.ip
 | WHERE Esql.dc_dataset >= 2
+| Keep source.ip, Esql.dc_dataset, Esql.users
 '''
 
 
