mirror of
https://github.com/elastic/detection-rules
synced 2026-06-08 14:00:08 +00:00
Isai
eca6afabc7
* [Rule Tuning] Forwarded Google Workspace Security Alert
- reduced execution interval
** we have a pending Integrations request to reduce the default lag ingest time from 2 hours to 3-5 minutes since the data is available near real time. Until that request is made we will keep the large look back window as is.
- replace `rule_name_override` with the ECS field `rule.name` which is derived from the original rule name field of the Security Rule. While in most cases the field we had `google_workspace.alert.type` was the same value, in some cases it is different showing that `rule.name` is the proper field for this.
Otherwise the rule is triggering as expected, including the severity_override fields
* remove filebeat, revert rule_name_override
Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>
* specified .alert-* index
(cherry picked from commit af2811386f)