Skip to content

Commit

Permalink
Update datafeed_high_count_network_denies.json (#101681) (#101825)
Browse files Browse the repository at this point in the history
add a boolean OR between the two possible field values

Co-authored-by: Craig Chamberlain <[email protected]>
  • Loading branch information
kibanamachine and randomuserid authored Jun 9, 2021
1 parent 868a713 commit eb7fad6
Showing 1 changed file with 22 additions and 3 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,29 @@
"term": {
"event.category": "network"
}
},
}
],
"must": [
{
"term": {
"event.outcome": "deny"
"bool": {
"should": [
{
"match": {
"event.outcome": {
"query": "deny",
"operator": "OR"
}
}
},
{
"match": {
"event.type": {
"query": "denied",
"operator": "OR"
}
}
}
]
}
}
]
Expand Down

0 comments on commit eb7fad6

Please sign in to comment.