Update credential_access_multi_could_secrets_via_api.toml

Samirbous · Samirbous · commit 335a5241fc44 · 2025-12-01T16:39:52.000Z
diff --git a/rules/cross-platform/credential_access_multi_could_secrets_via_api.toml b/rules/cross-platform/credential_access_multi_could_secrets_via_api.toml
@@ -119,7 +119,7 @@ FROM logs-* metadata _id, _version, _index
     /* Azure Managed HSM secret */
     (
      event.dataset == "azure.activitylogs" AND
-      azure.activitylogs.operation_name LIKE "MICROSOFT.KEYVAULT/managedHSM/keys/*")
+      azure.activitylogs.operation_name LIKE "MICROSOFT.KEYVAULT/managedHSM/keys/*"
     )
 
     OR

Original file line number	Diff line number	Diff line change
`@@ -119,7 +119,7 @@ FROM logs-* metadata _id, _version, _index`
`119`	`119`	`/* Azure Managed HSM secret */`
`120`	`120`	`(`
`121`	`121`	`event.dataset == "azure.activitylogs" AND`
`122`		`- azure.activitylogs.operation_name LIKE "MICROSOFT.KEYVAULT/managedHSM/keys/*")`
	`122`	`+ azure.activitylogs.operation_name LIKE "MICROSOFT.KEYVAULT/managedHSM/keys/*"`
`123`	`123`	`)`
`124`	`124`
`125`	`125`	`OR`