[Rule Tuning] Network Traffic Capture via CAP_NET_RAW

### Link to Rule

[[_No response_](https://github.com/elastic/detection-rules/blob/ce3916f99fdf7e886d2889d7a815f59a248b7aff/rules_building_block/discovery_capnetraw_capability.toml)](https://github.com/elastic/detection-rules/blob/ce3916f99fdf7e886d2889d7a815f59a248b7aff/rules_building_block/discovery_capnetraw_capability.toml)

### Rule Tuning Type

False Positives - Reducing benign events mistakenly identified as threats.

### Description

The rule triggers for certain well-known processes requiring `CAP_NET_RAW`.

I've only seen it for `kea-dhcp4`, particularly since it's not run by `root` which is excluded from the rule. There may be similar services though.

### Example Data

```
{
"_index": ".ds-logs-endpoint.events.process-default-2026.02.28-000102",
"_id": "AZy6gvwS7uwW5ABH2jYq",
"_score": 1,
"_source": {
"@timestamp": "2026-03-04T20:20:00.844Z",
"agent": {
"id": "f56a840f-2287-4024-9ce7-5ab7a5f69020",
"type": "endpoint",
"version": "9.3.0"
},
"data_stream": {
"dataset": "endpoint.events.process",
"namespace": "default",
"type": "logs"
},
"ecs": {
"version": "8.10.0"
},
"elastic": {
"agent": {
"id": "x"
}
},
"event": {
"action": [
"exec"
],
"agent_id_status": "verified",
"category": [
"process"
],
"created": "2026-03-04T20:20:00.844Z",
"dataset": "endpoint.events.process",
"id": "ONuaJlwT4Jzzw2Au+++/EylM",
"ingested": "2026-03-04T20:20:26Z",
"kind": "event",
"module": "endpoint",
"outcome": "unknown",
"sequence": 11053914,
"type": [
"start"
]
},
"group": {
"Ext": {
"real": {
"id": "972",
"name": "kea"
}
},
"id": "972",
"name": "kea"
},
"host": {
"architecture": "x86_64",
"hostname": "x",
"id": "x",
"ip": [
"x"
],
"mac": [
"x"
],
"name": "x",
"os": {
"Ext": {
"variant": "Red Hat"
},
"family": "red hat",
"full": "Red Hat 8.10",
"kernel": "4.18.0-553.107.1.el8_10.x86_64 #1 SMP Tue Feb 17 05:52:05 EST 2026",
"name": "Linux",
"platform": "red hat",
"type": "linux",
"version": "8.10"
}
},
"message": "Endpoint process event",
"process": {
"Ext": {
"ancestry": [
"vRE2SssiA19+uHAnot2yZA"
]
},
"args": [
"/usr/sbin/kea-dhcp4",
"-c",
"/etc/kea/kea-dhcp4.conf"
],
"args_count": 3,
"command_line": "/usr/sbin/kea-dhcp4 -c /etc/kea/kea-dhcp4.conf",
"entity_id": "AvM+Hs4dcrHCa3ZPhLVlpA",
"entry_leader": {
"args": [
"/usr/sbin/kea-dhcp4",
"-c",
"/etc/kea/kea-dhcp4.conf"
],
"args_count": 3,
"entity_id": "AvM+Hs4dcrHCa3ZPhLVlpA",
"entry_meta": {
"type": "init"
},
"executable": "/usr/sbin/kea-dhcp4",
"group": {
"id": "972",
"name": "kea"
},
"interactive": false,
"name": "kea-dhcp4",
"parent": {
"entity_id": "vRE2SssiA19+uHAnot2yZA",
"pid": 1,
"start": "2026-02-25T07:35:39.020Z"
},
"pid": 616495,
"real_group": {
"id": "972",
"name": "kea"
},
"real_user": {
"id": "973",
"name": "kea"
},
"same_as_process": true,
"start": "2026-03-04T20:20:00.830Z",
"user": {
"id": "973",
"name": "kea"
},
"working_directory": "/"
},
"executable": "/usr/sbin/kea-dhcp4",
"group": {
"id": "972",
"name": "kea"
},
"group_leader": {
"args": [
"/usr/sbin/kea-dhcp4",
"-c",
"/etc/kea/kea-dhcp4.conf"
],
"args_count": 3,
"entity_id": "AvM+Hs4dcrHCa3ZPhLVlpA",
"executable": "/usr/sbin/kea-dhcp4",
"group": {
"id": "972",
"name": "kea"
},
"interactive": false,
"name": "kea-dhcp4",
"pid": 616495,
"real_group": {
"id": "972",
"name": "kea"
},
"real_user": {
"id": "973",
"name": "kea"
},
"same_as_process": true,
"start": "2026-03-04T20:20:00.830Z",
"user": {
"id": "973",
"name": "kea"
},
"working_directory": "/"
},
"hash": {
"md5": "0fbc0bc10d0071d26f5cd32de4754e13",
"sha1": "a3638bddc2244b048923abc0936f7fb5d692af6f",
"sha256": "7cc9301682b49317bd09fe86773cff588b49a1aeb0295947526e3a622eada9df"
},
"interactive": false,
"name": "kea-dhcp4",
"parent": {
"args": [
"/usr/lib/systemd/systemd",
"--switched-root",
"--system",
"--deserialize",
"17"
],
"args_count": 5,
"command_line": "/usr/lib/systemd/systemd --switched-root --system --deserialize 17",
"entity_id": "vRE2SssiA19+uHAnot2yZA",
"executable": "/usr/lib/systemd/systemd",
"group": {
"id": "0",
"name": "root"
},
"interactive": false,
"name": "systemd",
"pid": 1,
"real_group": {
"id": "0",
"name": "root"
},
"real_user": {
"id": "0",
"name": "root"
},
"start": "2026-02-25T07:35:39.020Z",
"user": {
"id": "0",
"name": "root"
},
"working_directory": "/"
},
"pid": 616495,
"previous": [
{
"args": [
"/usr/lib/systemd/systemd",
"--switched-root",
"--system",
"--deserialize",
"17"
],
"args_count": 5,
"executable": "/usr/lib/systemd/systemd"
}
],
"real_group": {
"id": "972",
"name": "kea"
},
"real_user": {
"id": "973",
"name": "kea"
},
"session_leader": {
"args": [
"/usr/sbin/kea-dhcp4",
"-c",
"/etc/kea/kea-dhcp4.conf"
],
"args_count": 3,
"entity_id": "AvM+Hs4dcrHCa3ZPhLVlpA",
"executable": "/usr/sbin/kea-dhcp4",
"group": {
"id": "972",
"name": "kea"
},
"interactive": false,
"name": "kea-dhcp4",
"pid": 616495,
"real_group": {
"id": "972",
"name": "kea"
},
"real_user": {
"id": "973",
"name": "kea"
},
"same_as_process": true,
"start": "2026-03-04T20:20:00.830Z",
"user": {
"id": "973",
"name": "kea"
},
"working_directory": "/"
},
"start": "2026-03-04T20:20:00.830Z",
"thread": {
"capabilities": {
"effective": [
"CAP_NET_BIND_SERVICE",
"CAP_NET_RAW"
],
"permitted": [
"CAP_NET_BIND_SERVICE",
"CAP_NET_RAW"
]
}
},
"user": {
"id": "973",
"name": "kea"
},
"working_directory": "/"
},
"user": {
"Ext": {
"real": {
"id": "973",
"name": "kea"
}
},
"id": "973",
"name": "kea"
}
}
}
```