Remove event limit from error log rule

Aegrah · web-flow · commit a3ea3678fe1c · 2025-11-24T14:24:14.000+01:00
Removed limit on the number of events in the rule.
diff --git a/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml b/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml
@@ -52,7 +52,6 @@ from
     by source.ip, agent.id
 | where
     Esql.event_count > 25
-| limit 100
 '''
 
 [[rule.threat]]
