Factually incorrect and suggested scripts and files not existent

首先在 copilot-cli 中重現已回報的工作流程，並將產生的參照與 data/Kibana_dashboard_objects/...CROSSWALK.csv 及現有的驗證 notebook 進行比較。檢查模型如何呈現 render.py、compare.py、render_alert.py、compare_alerts.py 以及 dataset 名稱。完成的標準是：產生的指南能區分現有檔案與資料和建議的檔案，或清楚標示建立步驟。

Describe the bug

The model described steps to perform the data discovery and alert building based upon the current files existing in the folder. However, although the steps sound logical and positively feasible, the files such as render.py, compare.py. etc are not truly present. They are purely made up by the model, in addition, when assessing the details about the crosswalk from index to the datastream in elastic, although the actual file was there in .csv format, the suggested transition from the index to the stream mentioned by the model was not existing in reality. The name of the dataset is not real either.

Affected version

No response

Steps to reproduce the behavior

Here is the step-by-step practical guide using the (redacted)/  as our working example.

────────────────────

End-to-End Workflow Map

[ Step 1: Data Discovery & Crosswalk ]
│ (Find source index, target datastream & ECS fields)
▼
[ Step 2: ES|QL Query Formulation & Data Evidence ]
│ (Convert SPL → ES|QL & test in Jupyter / Dev Tools)
▼
[ Step 3: YAML Specification & JSON Rendering ]
│ (Write spec-*.yaml → run render_alert.py)
▼
[ Step 4: Dry-Run Diff & Push to Kibana ]
│ (compare_alerts.py → render_alert.py --push)
▼
[ Step 5: Master Index Confirmation ]
(Update ALERTS_INDEX.md status)

────────────────────

Step 1: Data Discovery & Crosswalk Mapping

Goal: Determine where the Splunk data lives in Elasticsearch.

1. Inspect the original Splunk query (from  redacted):
   index=redacted apiName="inf-bnkng-party-physaccsprof-accsprofvecos-v1"
   | where apiPath="redacted"
   | where responseCode >= 400
2. Find the target Data Stream:
   Look up in  data/Kibana_dashboard_objects/...CROSSWALK.csv :
   • Splunk  redacted redacted logs $\rightarrow$  redacted 
   • Dataset:  redacted 
3. Map the Fields:
   •  apiPath  $\rightarrow$  redacted
   •  redacted  $\rightarrow$  redacted
   ────────────────────

Step 2: ES|QL Formulation & Data Evidence

Goal: Formulate and test the query against live data to verify hits.

1. ES|QL Query Formulation:
   redacted
2. Test & Verify:
   • Run in Kibana Discover $\rightarrow$ ES|QL tab or in a verification notebook ( redacted.md ).
   • Confirmation Criteria: Ensure no field type errors and that the count calculation matches expected failure counts.

────────────────────

Step 3: Create redacted

Goal: Avoid writing bulky Kibana JSON by using human-readable YAML.

1. Create or edit the YAML spec ( redacted):
   rule_id: "auto"
   name: "redacted"
   tags: ["redacted"]
   schedule_interval: "5m"
   time_window:
   size: 5
   unit: "m"
   esql: |
   redacted
   email:
   to: ["redacted]
   subject: "{{context.hits.0._source.labels.environment}} - redacted."
   snow:
   node: "redacted"
   resource: "/"
   metric_name: "redacted"
   short_description: "redacted"
2. Execute Python Rendering Script:

────────────────────

Step 4: Diff & Push to Kibana


### Expected behavior

Accurate to the individual details mentioned in the response from the file names, contents and inferred information (at least logical instead of making it up). The model should have suggested to create the files, instead of making them up to mislead.

### Additional context

_No response_