Update credential_access_multi_could_secrets_via_api.toml

Author: Samirbous

rules/cross-platform/credential_access_multi_could_secrets_via_api.toml

@@ -13,7 +13,7 @@ to retrieve secrets from services such as AWS Secrets Manager, Google Secret Man
 succession to expand their access or exfiltrate sensitive information.
 """
 from = "now-9m"
-interval = "1m"
+interval = "5m"
 language = "esql"
 license = "Elastic License v2"
 name = "Multiple Cloud Secrets Accessed by Source Address"
@@ -113,7 +113,7 @@ FROM logs-azure.platformlogs-*, logs-azure.activitylogs-*, logs-aws.cloudtrail-*
 | WHERE 
   ( 
     /* AWS Secrets Manager */ 
-    (event.dataset == "aws.cloudtrail" AND event.provider == "secretsmanager.amazonaws.com" AND event.action IN ("GetSecretValue", "BatchGetSecretValue")) OR 
+    (event.dataset == "aws.cloudtrail" AND event.provider == "secretsmanager.amazonaws.com" AND event.action == "GetSecretValue") OR 
 
     // Azure Key Vault (platform logs)
     (event.dataset == "azure.platformlogs" AND event.action IN ("SecretGet", "KeyGet")) or