removed protocol inclusion in query

Author: terrancedejesus

detection_rules/etc/non-ecs-schema.json

@@ -150,8 +150,7 @@
   "logs-aws.cloudtrail-*": {
     "aws.cloudtrail.flattened.request_parameters.cidrIp": "keyword",
     "aws.cloudtrail.flattened.request_parameters.fromPort": "keyword",
-    "aws.cloudtrail.flattened.request_parameters.roleArn": "keyword",
-    "aws.cloudtrail.request_parameters.protocol": "keyword"
+    "aws.cloudtrail.flattened.request_parameters.roleArn": "keyword"
   },
   "logs-azure.signinlogs-*": {
     "azure.signinlogs.properties.conditional_access_audiences.application_id": "keyword"

rules/integrations/aws/exfiltration_sns_email_subscription_by_rare_user.toml

@@ -78,7 +78,7 @@ query = '''
 event.dataset: "aws.cloudtrail"
     and event.provider: "sns.amazonaws.com"
     and event.action: "Subscribe"
-    and aws.cloudtrail.request_parameters.protocol: "email"
+    and aws.cloudtrail.request_parameters: *protocol=email*
 '''