Update credential_access_multi_could_secrets_via_api.toml

Author: Samirbous

rules/cross-platform/credential_access_multi_could_secrets_via_api.toml

@@ -132,12 +132,13 @@ FROM logs-* metadata _id, _version, _index
  )
  AND source.ip IS NOT NULL
 | STATS
+    Esql.events_count = COUNT(*),
     Esql.dc_dataset = COUNT_DISTINCT(event.dataset),
     Esql.event_action_values = VALUES(event.action),
     Esql.users = VALUES(user.name)
   BY source.ip
 | WHERE Esql.dc_dataset >= 2
-| Keep source.ip, Esql.dc_dataset, Esql.users
+| Keep source.ip, Esql.dc_dataset, Esql.users, Esql.events_count
 '''