Update credential_access_multi_could_secrets_via_api.toml

Author: Samirbous

rules/cross-platform/credential_access_multi_could_secrets_via_api.toml

@@ -110,34 +110,25 @@ type = "esql"
 
 query = '''
 FROM logs-azure.platformlogs-*, logs-azure.activitylogs-*, logs-aws.cloudtrail-*, logs-gcp.audit-* METADATA _id, _version, _index
-| WHERE source.ip IS NOT NULL
-
-// Normalize "secret access" across AWS, Azure, GCP
-| EVAL Esql.is_secret_access = CASE(
-    // AWS Secrets Manager
-    event.dataset == "aws.cloudtrail" AND
-    event.provider == "secretsmanager.amazonaws.com" AND
-    event.action IN ("GetSecretValue", "BatchGetSecretValue"), true,
+| WHERE 
+  ( 
+    /* AWS Secrets Manager */ 
+    (event.dataset == "aws.cloudtrail" AND event.provider == "secretsmanager.amazonaws.com" AND event.action IN ("GetSecretValue", "BatchGetSecretValue")) OR 
 
     // Azure Key Vault (platform logs)
-    event.dataset == "azure.platformlogs" AND
-    event.action IN ("SecretGet", "KeyGet"), true,
-
-    // Azure Managed HSM secret
-    event.dataset == "azure.activitylogs" AND
-    event.action LIKE "MICROSOFT.KEYVAULT/managedHSM/keys/*", true,
-
-    // Google Secret Manager
-    event.dataset IN ("googlecloud.audit", "gcp.audit") AND
-    event.action IN (
-      "google.cloud.secretmanager.v1.SecretManagerService.GetSecretRequest",
-      "google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion"
-    ), true,
-
-    // default
-    false
-  )
-| WHERE Esql.is_secret_access
+    (event.dataset == "azure.platformlogs" AND event.action IN ("SecretGet", "KeyGet")) or 
+
+    /* Azure Key Vault (activity logs) */ 
+    (event.dataset == "azure.activitylogs" AND (azure.activitylogs.operation_name LIKE "MICROSOFT.KEYVAULT/VAULTS/SECRETS/LIST" OR azure.activitylogs.operation_name LIKE "MICROSOFT.KEYVAULT/VAULTS/SECRETS/GET")) OR 
+
+    /* Azure Managed HSM secret */ 
+    (event.dataset == "azure.activitylogs" AND azure.activitylogs.operation_name LIKE "MICROSOFT.KEYVAULT/managedHSM/keys/*") OR 
+
+    /* Google Secret Manager */ 
+    (event.dataset IN ("googlecloud.audit", "gcp.audit") AND 
+     event.action IN ("google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion", "google.cloud.secretmanager.v1.SecretManagerService.GetSecretRequest"))
+
+   ) AND source.ip IS NOT NULL
 
 // Unified user identity (raw)
 | EVAL Esql_priv.user_id =
@@ -167,7 +158,7 @@ FROM logs-azure.platformlogs-*, logs-azure.activitylogs-*, logs-aws.cloudtrail-*
 | STATS
     // Core counts
     Esql.events_count = COUNT(*),
-    Esql.dataset_count_distinct = COUNT_DISTINCT(event.dataset),
+    Esql.vendor_count_distinct = COUNT_DISTINCT(Esql.cloud_vendor),
 
     // Action & data source context
     Esql.event_action_values = VALUES(event.action),
@@ -193,8 +184,8 @@ FROM logs-azure.platformlogs-*, logs-azure.activitylogs-*, logs-aws.cloudtrail-*
     Esql_priv.azure_upn_values = VALUES(azure.platformlogs.identity.claim.upn)
   BY source.ip
 
-// Require multi-dataset behavior from same source IP
-| WHERE Esql.dataset_count_distinct >= 2
+// Require multi-vendor cred-access from same source IP
+| WHERE Esql.vendor_count_distinct >= 2
 | SORT Esql.events_count DESC
 | KEEP Esql.*, Esql_priv.*, source.ip
 '''