Update datafeed_high_count_network_denies.json (#101681)

add a boolean OR between the two possible field values
elastic · Jun 9, 2021 · dd45015 · dd45015
1 parent db3c58c
commit dd45015
Showing 1 changed file with 22 additions and 3 deletions.
diff --git a/...odels/data_recognizer/modules/security_network/ml/datafeed_high_count_network_denies.json b/...odels/data_recognizer/modules/security_network/ml/datafeed_high_count_network_denies.json
@@ -13,10 +13,29 @@
           "term": {
             "event.category": "network"
           }
-        },
+        }
+      ],
+      "must": [
         {
-          "term": {
-            "event.outcome": "deny"
+          "bool": {
+            "should": [
+              {
+                "match": {
+                  "event.outcome": {
+                    "query": "deny",
+                    "operator": "OR"
+                  }
+                }
+              },
+              {
+                "match": {
+                  "event.type": {
+                    "query": "denied",
+                    "operator": "OR"
+                  }
+                }
+              }
+            ]
           }
         }
       ]