Skip to content

Commit 72ba122

Browse files
Update create-detection-rule.md
1 parent 39f0c9d commit 72ba122

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

solutions/security/detect-and-alert/create-detection-rule.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -282,7 +282,7 @@ To filter noisy {{ml}} rules, use [rule exceptions](/solutions/security/detect-a
282282
283283
6. (Optional) Add more threat mapping entries and combine them with `AND` and `OR` clauses.
284284
285-
For example, to create a rule that generates alerts when `host.name` **and** `destination.ip` field values in the `logs-*` or `packetbeat-*` {{elastic-sec}} indices are identical to the corresponding mapped field values in the `logs-ti_*` indicator index, enter the rule parameters seen in the following image:
285+
For example, to create a rule that generates alerts when `host.name` **and** `destination.ip` field values in the `logs-*` or `packetbeat-*` {{elastic-sec}} indices are identical to the corresponding field values in the `logs-ti_*` indicator index, enter the rule parameters seen in the following image:
286286
287287
:::{image} /solutions/images/security-indicator-rule-example.png
288288
:alt: Indicator match rule settings

0 commit comments

Comments
 (0)