Update credential_access_multi_could_secrets_via_api.toml

Samirbous · Samirbous · commit ffc2515b52b3 · 2025-12-01T16:57:43.000Z
diff --git a/rules/cross-platform/credential_access_multi_could_secrets_via_api.toml b/rules/cross-platform/credential_access_multi_could_secrets_via_api.toml
@@ -114,7 +114,7 @@ FROM logs-* metadata _id, _version, _index
     (
       event.dataset == "azure.activitylogs"
       AND azure.activitylogs.operation_name LIKE "MICROSOFT.KEYVAULT/VAULTS/SECRETS/*")
-    ) or
+    ) OR
 
     /* Azure Managed HSM secret */
     (

Original file line number	Diff line number	Diff line change
`@@ -114,7 +114,7 @@ FROM logs-* metadata _id, _version, _index`
`114`	`114`	`(`
`115`	`115`	`event.dataset == "azure.activitylogs"`
`116`	`116`	`AND azure.activitylogs.operation_name LIKE "MICROSOFT.KEYVAULT/VAULTS/SECRETS/*")`
`117`		`- ) or`
	`117`	`+ ) OR`
`118`	`118`
`119`	`119`	`/* Azure Managed HSM secret */`
`120`	`120`	`(`