An Elastic SIEM rule goes quiet (siem-rule-followed-legacy-field-after-semantic-drift)

Data still arrives, yet the rule follows a field whose semantics changed during normalization and no longer represent the admin action it expects.