Elastic medium stable kql

Elastic Security External Alerts

Generates a detection alert for each Elastic Security alert written to the configured indices. Enabling this rule allows you to immediately begin investigating Elastic Security alerts in the app.

View Source

Detection Logic

event.kind: alert and data_stream.dataset: elastic_security.alert

Field Validations

Loading…

Comments (0)

Loading comments...