Elastic medium stable kql

Container Workload Protection

Generates a detection alert each time a 'Container Workload Protection' alert is received. Enabling this rule allows you to immediately begin triaging and investigating these alerts.

View Source

Detection Logic

event.kind:alert and event.module:cloud_defend

Field Validations

Loading…

Comments (0)

Loading comments...