An Elastic SIEM rule goes quiet (siem-correlation-followed-legacy-field-after-semantic-drift)

Events still arrive, yet the rule watches a field whose meaning changed during normalization and no longer represents the admin action it expects.