ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule - "[subsearch]: The lookup table 'previously_seen_provisioning_activity_src.csv' requires a .csv or KV store lookup definition." about security_content HOT 5 CLOSED

We would appreciate it if you could provide us with more info about this issue/pr!

from security_content.

from security_content.

@kkolli4 :Hey Durga, ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule - this particular search name is not in the list of Beta searches listed here: https://docs.google.com/spreadsheets/d/1K8xMy3jX_PeF__QU-0sP-r7n2HwMMUQpnYfvHF_rEi4/edit#gid=1166574115

I think you want to look for and test ESCU - Cloud Provisioning From Previously Unseen City - Rule .

Note: the updated search name for Mustang does not have AWS in the search title

from security_content.

also, Thank you @kkolli4 for pointing out naming inconsistency: I have updated the sheet with correct titles

from security_content.

The previous search AWS Cloud Provisioning From Previously Unseen City still shows an error but we intend to deprecate it since customers should use the latest Change Datamodel(yet to be released)

from security_content.