Possible bug in rule: "AWS Activity In New Region" about security_content HOT 5 CLOSED

It definetly looks to be the case @tdziwok, thank you for pointing this out! We will work on a PR to get it fixed up. If you did any changes to the search it would be great if you could shared it as an example fix 😄

from security_content.

Hey added a PR to fix this #345 should be fixed in the next release.

from security_content.

Hi @d1vious,

Thanks for looking into this so quickly.
The fix you applied is exactly what I had used; sorry for not sharing it earlier :).

I believe I have found one more instance of the same issue by using:

grep  -irE '([^`]|^)security_content_ctime' ./detections/

./detections/ec2_instance_started_with_previously_unseen_instance_type.yml has the same exact pattern and needs the same exact fix.

Thanks for your help, and keep up the awesome work!

Thanks,
Tomasz

from security_content.

@tdziwok thank you for sharing this one too, re-opened the issue for now. I will make another PR to solve this one.

from security_content.

@tdziwok added another PR in there to include this search. Thank you again for catching this error!

from security_content.