[Rule Tuning] Unusual Process Spawned from Web Server Parent, missing fields

[girtsLv]

Link to Rule

https://github.com/elastic/detection-rules/blob/b28338c680164ef5373115c610cde9d9467a69a9/rules/linux/persistence_web_server_sus_child_spawned.toml

Rule Tuning Type

Data Quality - Ensuring integrity and quality of data used by detection rules.

Description

The "Unusual Process Spawned from Web Server Parent" detection rule is missing some fields that does not allow to complete the investigation.

Fields to be added
- host.name
- process.command_line
- user.name

Fields to be added (optional)
- process.name
- process.pid
- process.args
- parent.process.pid
- parent.process.name

Example Data

No response