Skip to content

Commit f373b78

Browse files
committed
Update credential_access_new_terms_secretsmanager_getsecretvalue.toml
1 parent 18dff48 commit f373b78

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

rules/integrations/aws/credential_access_new_terms_secretsmanager_getsecretvalue.toml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/07/06"
33
integration = ["aws"]
44
maturity = "production"
5-
updated_date = "2025/08/18"
5+
updated_date = "2025/12/12"
66

77
[rule]
88
author = ["Nick Jones", "Elastic"]
@@ -97,7 +97,7 @@ type = "new_terms"
9797
query = '''
9898
event.dataset:aws.cloudtrail and event.provider:secretsmanager.amazonaws.com and
9999
event.action: (GetSecretValue or BatchGetSecretValue) and event.outcome:success and
100-
not user_agent.name: ("Chrome" or "Firefox" or "Safari" or "Edge" or "Brave" or "Opera")
100+
not user_agent.name: ("Chrome" or "Firefox" or "Safari" or "Edge" or "Brave" or "Opera" or "Boto3")
101101
'''
102102

103103
[rule.investigation_fields]

0 commit comments

Comments
 (0)