Error in detection rule: Remote Computer Account DnsHostName Update

Since data loss is not a problem, removing the conflicting index should fix the issue.

Just go into Kibana > Dev Tools and run this request:

DELETE .ds-logs-system.security-default-2025.03.16-000049

This will delete the backing indice .ds-logs-system.security-default-2025.03.16-000049 for the data stream logs-system.security-default, the data will be removed from the cluster and the conflict will stop as all other backing indices have the correct mapping.

1 Like