[Rule Tuning] Suricata and Elastic Defend Network Correlation

[eric-forte-elastic]

Pull Request

Issue link(s):

Related to #6491

Summary - What I changed

Small tuning PR to reconcile a cross platform rule with our updated ECS restrictions. Previously, it appeared that source.domain was present in Suricata, but it is not. See #6491 (comment) and https://github.com/elastic/ia-trade-team/issues/1036 for more detail.

How To Test

Verify in telemetry and test against #6491.

Checklist

• Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
• Added the meta:rapid-merge label if planning to merge within 24 hours
• Secret and sensitive material has been managed correctly
• Automated testing was updated or added to match the most common scenarios
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[elastic-vault-github-plugin-prod]

⛔️ Test failed

Results

• ❌ Suricata and Elastic Defend Network Correlation (eql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta

[Copilot]

🟢 Approval recommended

The change is a straightforward rule-tuning adjustment removing an invalid field reference and updating metadata, with no other functional modifications.

Pull request overview

This PR tunes an existing cross-platform EQL correlation rule to align with updated ECS/integration field restrictions by removing a Suricata-side filter that referenced an ECS field not populated by the Suricata integration.

Changes:

• Updated rule metadata updated_date to reflect the tuning date.
• Removed the source.domain exclusion from the Suricata portion of the EQL sequence to avoid referencing an unavailable field.

File summaries

File	Description
rules/cross-platform/command_and_control_suricata_elastic_defend_c2.toml	Removes unsupported source.domain predicate from the Suricata clause and updates rule metadata date.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.