Elastic critical deprecated kql
Deprecated - Threat Intel Filebeat Module (v8.x) Indicator Match
This rule is triggered when indicators from the Threat Intel Filebeat module (v8.x) has a match against local file or network observations. This rule was deprecated. See the Setup section for more information and alternative rules.
Detection Logic
file.hash.*:* or file.pe.imphash:* or source.ip:* or destination.ip:* or url.full:* or registry.path:*Field Validations
Loading…
Comments (0)
Loading comments...