Elastic medium stable kql
External Alerts
Generates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to immediately begin investigating external alerts in the app.
Detection Logic
event.kind:alert and not event.module:(endgame or endpoint or cloud_defend)Field Validations
Loading…
Comments (0)
Loading comments...