Skip to content

Commit a9537a8

Browse files
authored
Update multiple_alerts_from_different_modules_by_srcip.toml
1 parent f1ece8a commit a9537a8

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

rules/cross-platform/multiple_alerts_from_different_modules_by_srcip.toml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ from .alerts-security.* metadata _id
3838
Esql.rule_name_values = VALUES(kibana.alert.rule.name),
3939
Esql.message_values = VALUES(message),
4040
Esql.event_category_values = VALUES(event.category),
41+
Esql.event_action_values = VALUES(event.action),
4142
Esql.destination_ip_values = VALUES(destination.ip),
4243
Esql.host_id_values = VALUES(host.id),
4344
Esql.agent_id_values = VALUES(agent.id),

0 commit comments

Comments
 (0)