[Rule Tuning] Potential Spike in Web Server Error Logs

[eric-forte-elastic]

Link to Rule

https://github.com/elastic/detection-rules/blob/main/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml

Rule Tuning Type

Data Quality - Ensuring integrity and quality of data used by detection rules.

Description

https://github.com/elastic/detection-rules/blob/main/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml is using the wrong indices. The should be logs-{integration}.error-* instead of logs-{integration}.access-* (Caught by @w0rk3r )

Example Data

No response