[ML] Fix packetbeat module query (elastic#65241) (elastic#65357)

simitt · May 6, 2020 · a2a9426 · a2a9426
1 parent a3d2a00
commit a2a9426
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/...odels/data_recognizer/modules/siem_packetbeat/ml/datafeed_packetbeat_rare_user_agent.json b/...odels/data_recognizer/modules/siem_packetbeat/ml/datafeed_packetbeat_rare_user_agent.json
@@ -7,7 +7,7 @@
   "query": {
     "bool": {
       "filter": [
-        {"term": {"event.dataset": "dns"}},
+        {"term": {"event.dataset": "http"}},
         {"term": {"agent.type": "packetbeat"}}
       ],
       "must_not": [