IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Endpoint Security
editEndpoint Security
editGenerates a detection alert each time an Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.
Rule type: query
Rule indices:
- logs-endpoint.alerts-*
Severity: medium
Risk score: 47
Runs every: 5 minutes
Searches indices from: now-10m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 10000
Tags:
- Elastic
- Endpoint Security
Version: 2 (version history)
Added (Elastic Stack release): 7.9.0
Last modified (Elastic Stack release): 7.10.0
Rule authors: Elastic
Rule license: Elastic License
Rule query
editevent.kind:alert and event.module:(endpoint and not endgame)
Rule version history
edit- Version 2 (7.10.0 release)
-
- Rule name changed from: Elastic Endpoint Security