Message formatting changes

Author: ljstella

detections/endpoint/linux_suspicious_react_or_next_js_child_process.yml

@@ -122,7 +122,8 @@ drilldown_searches:
     earliest_offset: $info_min_time$
     latest_offset: $info_max_time$
   - name: View risk events for the last 7 days for - "$dest$"
-    search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
+    search:
+      '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
       starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
       values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
       as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
@@ -131,7 +132,7 @@ drilldown_searches:
     earliest_offset: $info_min_time$
     latest_offset: $info_max_time$
 rba:
-  message: |
+  message:
     A Node-based server process ($parent_process_name$) on Linux spawned the
     child process $process_name$ with command-line $process$ on host $dest$ by user $user$, which may
     indicate remote code execution via React Server Components (CVE-2025-55182 /

detections/endpoint/windows_suspicious_react_or_next_js_child_process.yml

@@ -113,7 +113,8 @@ drilldown_searches:
     earliest_offset: $info_min_time$
     latest_offset: $info_max_time$
   - name: View risk events for the last 7 days for - "$dest$"
-    search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
+    search:
+      '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
       starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
       values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
       as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
@@ -122,8 +123,7 @@ drilldown_searches:
     earliest_offset: $info_min_time$
     latest_offset: $info_max_time$
 rba:
-  message: |
-    A Node-based server process ($parent_process_name$) spawned the child
+  message: A Node-based server process ($parent_process_name$) spawned the child
     process $process_name$ with command-line $process$ on host $dest$ by user $user$, which may indicate
     remote code execution via React Server Components (CVE-2025-55182 /
     React2Shell) or abuse of a similar Node.js RCE vector.