Skip to content

Commit b9d6e2d

Browse files
Update rules/cross-platform/multiple_alerts_from_different_modules_by_srcip.toml
Co-authored-by: Mika Ayenson, PhD <[email protected]>
1 parent 93ad776 commit b9d6e2d

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

rules/cross-platform/multiple_alerts_from_different_modules_by_srcip.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ from .alerts-security.* metadata _id
3333
| stats Esql.event_module_distinct_count = COUNT_DISTINCT(event.module),
3434
Esql.rule_name_distinct_count = COUNT_DISTINCT(kibana.alert.rule.name),
3535
Esql.event_category_distinct_count = COUNT_DISTINCT(event.category),
36-
Esql.rule_severity_distinct_count = COUNT_DISTINCT(kibana.alert.risk_score),
36+
Esql.rule_risk_score_distinct_count = COUNT_DISTINCT(kibana.alert.risk_score),
3737
Esql.event_module_values = VALUES(event.module),
3838
Esql.rule_name_values = VALUES(kibana.alert.rule.name),
3939
Esql.message_values = VALUES(message),

0 commit comments

Comments
 (0)