[Rule Tuning] Change event.dataset to data_stream.dataset#5943
Merged
terrancedejesus merged 4 commits intomainfrom Apr 10, 2026
Merged
[Rule Tuning] Change event.dataset to data_stream.dataset#5943terrancedejesus merged 4 commits intomainfrom
terrancedejesus merged 4 commits intomainfrom
Conversation
|
⛔️ Test failed Results
|
Contributor
Rule: Tuning - GuidelinesThese guidelines serve as a reminder set of considerations when tuning an existing rule. Documentation and Context
Rule Metadata Checks
Testing and Validation
|
botelastic
Bot
added
Domain: Cloud
Integration: AWS
|
⛔️ Test failed Results
|
terrancedejesus
requested review from
Aegrah,
DefSecSentinel,
eric-forte-elastic,
imays11 and
w0rk3r
Mikaayenson
approved these changes
Apr 10, 2026
Contributor
Mikaayenson
left a comment
Mikaayenson
left a comment
There was a problem hiding this comment.
LGTM. The only concern is that we will have to open a maintenance window to stitch together the minstacked rules. If we can prepare ahead of time, that would be great so we can minimize the window.
Here are the ones I found:
rules/cross-platform/discovery_web_server_local_file_inclusion_activity.tomlrules/cross-platform/discovery_web_server_remote_file_inclusion_activity.tomlrules/cross-platform/execution_d4c_k8s_mda_direct_interactive_kubernetes_api_request_by_usual_utilities.tomlrules/cross-platform/execution_d4c_k8s_mda_forbidden_direct_interactive_kubernetes_api_request.tomlrules/cross-platform/execution_d4c_k8s_mda_kubernetes_api_activity_by_unusual_utilities.tomlrules/cross-platform/execution_d4c_k8s_mda_service_account_token_access_followed_by_kubernetes_api_request.tomlrules/cross-platform/initial_access_elastic_defend_alert_genai_utility_descendant.tomlrules/cross-platform/initial_access_elastic_defend_alert_package_manager_ancestor.tomlrules/cross-platform/multiple_alerts_llm_compromised_user_triage.tomlrules/cross-platform/multiple_elastic_defend_behavior_rules_same_host_prevalence.tomlrules/integrations/aws/discovery_multiple_discovery_api_calls_via_cli.tomlrules/integrations/aws/discovery_organization_discovery_by_rare_user.tomlrules/integrations/aws/discovery_s3_rapid_bucket_posture_api_calls.tomlrules/integrations/aws/initial_access_iam_session_token_used_from_multiple_addresses.tomlrules/integrations/aws/persistence_aws_attempt_to_register_virtual_mfa_device.tomlrules/integrations/aws/persistence_iam_api_calls_via_user_session_token.tomlrules/integrations/aws/privilege_escalation_iam_customer_managed_policy_attached_to_role.tomlrules/integrations/aws/privilege_escalation_iam_update_assume_role_policy.tomlrules/integrations/azure/credential_access_entra_id_excessive_account_lockouts.tomlrules/integrations/github/impact_high_number_of_protected_branch_force_pushes_by_user.tomlrules/windows/defense_evasion_masquerading_as_svchost.toml
|
⛔️ Test failed Results
|
Contributor
Author
|
@Mikaayenson - Same here min_stack_version: 9.1.0 (2 rules) rules/integrations/azure/credential_access_entra_id_excessive_account_lockouts.toml min_stack_version: 9.2.0 (11 rules) min_stack_version: 9.3.0 (8 rules) |
imays11
approved these changes
Apr 10, 2026
Contributor
|
Some of the note text still refers to event.dataset, we may want to update that. (Example) |
|
|
||
| ### Possible investigation steps | ||
|
|
||
| - Review the Zoom event logs to identify the specific meeting details, including the meeting ID and the organizer's information, using the fields event.type, event.module, event.dataset, and event.action. |
Contributor
There was a problem hiding this comment.
Suggested change
| - Review the Zoom event logs to identify the specific meeting details, including the meeting ID and the organizer's information, using the fields event.type, event.module, data_stream.dataset, and event.action. |
Should this still be event.dataset? Or perhaps data_stream.dataset?
Contributor
Author
There was a problem hiding this comment.
Tried to keep the PR as minimal as possible and not adjust any investigation guides.
imays11
reviewed
Apr 10, 2026
|
⛔️ Test failed Results
|
This was referenced Apr 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
Issue link(s):
data_stream.datasetto all applicable integration rules #5940Summary - What I changed
Changes
event.datasettodata_stream.dataset. Please see issue for more details.How To Test
No testing of the rules were done. Logic has not changed, instead all integration related rules now depend on
data_stream.datasetas defined in each integration.This PR is a bit large and there are additional considerations. To help others when reviewing, here is a prompt that will help review nuances regarding these changes. Please let me know if you have any questions.
Checklist
bug,enhancement,schema,maintenance,Rule: New,Rule: Deprecation,Rule: Tuning,Hunt: New, orHunt: Tuningso guidelines can be generatedmeta:rapid-mergelabel if planning to merge within 24 hoursContributor checklist