Terrance DeJesus 906c43891c [Rule Tuning] Change event.dataset to data_stream.dataset (#5943) ...

* [Rule Tuning] Change event.dataset to data_stream.dataset

* updating ESQL field names

Removed changes from:
- rules/cross-platform/execution_d4c_k8s_mda_direct_interactive_kubernetes_api_request_by_usual_utilities.toml
- rules/cross-platform/execution_d4c_k8s_mda_forbidden_direct_interactive_kubernetes_api_request.toml
- rules/cross-platform/execution_d4c_k8s_mda_kubernetes_api_activity_by_unusual_utilities.toml
- rules/cross-platform/execution_d4c_k8s_mda_service_account_token_access_followed_by_kubernetes_api_request.toml
- rules/cross-platform/initial_access_elastic_defend_alert_genai_utility_descendant.toml
- rules/cross-platform/initial_access_elastic_defend_alert_package_manager_ancestor.toml
- rules/cross-platform/multiple_alerts_llm_compromised_user_triage.toml
- rules/cross-platform/multiple_elastic_defend_behavior_rules_same_host_prevalence.toml

(selectively cherry picked from commit deab1c0161)

2026-04-10 16:31:06 +00:00

..

persistence_suspicious_file_modifications.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:06 +00:00