Skip to content

Commit f1ece8a

Browse files
authored
Update multiple_alerts_from_different_modules_by_dstip.toml
1 parent e34d0c3 commit f1ece8a

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

rules/cross-platform/multiple_alerts_from_different_modules_by_dstip.toml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ from .alerts-security.* metadata _id
3737
Esql.rule_name_values = VALUES(kibana.alert.rule.name),
3838
Esql.message_values = VALUES(message),
3939
Esql.event_category_values = VALUES(event.category),
40+
Esql.event_action_values = VALUES(event.action),
4041
Esql.source_ip_values = VALUES(source.ip),
4142
Esql.host_id_values = VALUES(host.id),
4243
Esql.agent_id_values = VALUES(agent.id),

0 commit comments

Comments
 (0)