Skip to content

Commit 08d4013

Browse files
Update rules/integrations/azure/initial_access_azure_arc_cluster_credential_access_unusual_source.toml
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
1 parent bca6542 commit 08d4013

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

rules/integrations/azure/initial_access_azure_arc_cluster_credential_access_unusual_source.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ that rotate IPs but maintain consistent identity-to-IP patterns over time.
1717
false_positives = [
1818
"""
1919
A service principal used by a CI/CD pipeline may trigger this rule when the pipeline runs from a new IP range for
20-
the first time (e.g., migrating to a new runner pool). The 14-day history window will learn the new IPs after the
20+
the first time (e.g., migrating to a new runner pool). The 7-day history window will learn the new IPs after the
2121
first occurrence.
2222
""",
2323
"""

0 commit comments

Comments
 (0)