removed file beat compatibility missing category for AttachRolePolicy

imays11 · imays11 · commit 320638693244 · 2025-10-15T13:30:09.000-04:00
filebeat does not have category mapping for AttachRolePolicy event
diff --git a/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_role.toml b/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_role.toml
@@ -15,7 +15,7 @@ false_positives = [
     """,
 ]
 from = "now-6m"
-index = ["filebeat-*", "logs-aws.cloudtrail-*"]
+index = ["logs-aws.cloudtrail-*"]
 language = "eql"
 license = "Elastic License v2"
 name = "AWS IAM AdministratorAccess Policy Attached to Role"

Original file line number	Diff line number	Diff line change
`@@ -15,7 +15,7 @@ false_positives = [`
`15`	`15`	`""",`
`16`	`16`	`]`
`17`	`17`	`from = "now-6m"`
`18`		`-index = ["filebeat-", "logs-aws.cloudtrail-"]`
	`18`	`+index = ["logs-aws.cloudtrail-*"]`
`19`	`19`	`language = "eql"`
`20`	`20`	`license = "Elastic License v2"`
`21`	`21`	`name = "AWS IAM AdministratorAccess Policy Attached to Role"`