A SIEM dashboard shows the new field names, but the scheduled incident export still queries the old schema and sends empty nightly reports

Interactive analysis is fine, yet one automated reporting path still depends on the legacy field map.