Skip to content

Commit 9716738

Browse files
Update rules/cross-platform/multiple_alerts_from_different_modules_by_user.toml
Co-authored-by: Mika Ayenson, PhD <[email protected]>
1 parent b9d6e2d commit 9716738

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

rules/cross-platform/multiple_alerts_from_different_modules_by_user.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ from .alerts-security.* metadata _id
3434
| stats Esql.event_module_distinct_count = COUNT_DISTINCT(event.module),
3535
Esql.rule_name_distinct_count = COUNT_DISTINCT(kibana.alert.rule.name),
3636
Esql.event_category_distinct_count = COUNT_DISTINCT(event.category),
37-
Esql.rule_severity_distinct_count = COUNT_DISTINCT(kibana.alert.risk_score),
37+
Esql.rule_risk_score_distinct_count = COUNT_DISTINCT(kibana.alert.risk_score),
3838
Esql.event_module_values = VALUES(event.module),
3939
Esql.rule_name_values = VALUES(kibana.alert.rule.name),
4040
Esql.message_values = VALUES(message),

0 commit comments

Comments
 (0)