An Elastic detection rule still misses one attacker path

The event exists, yet the detection misses because the normalized schema changed which field carries the attacker IP in proxied cases.