Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extend filter pattern for the query <log_metric_filter_root_login.sql> #284

Closed
rajlearner17 opened this issue Sep 21, 2021 · 0 comments · Fixed by #285
Closed

Extend filter pattern for the query <log_metric_filter_root_login.sql> #284

rajlearner17 opened this issue Sep 21, 2021 · 0 comments · Fixed by #285
Assignees
Labels
bug Something isn't working

Comments

@rajlearner17
Copy link
Contributor

rajlearner17 commented Sep 21, 2021

Describe the bug
log_metric_filter_root_login.sql shared in
cis_v130_4_3
cis_v140_4_3
pci_v321_cw_1

The event pattern mentioned as required is

"filterPattern": "{ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }"

However, the query only contains
filter_pattern ~ '\s*\$\.userIdentity.type\s*=\s*"Root"'

To reproduce
Steps to reproduce the behavior (please include relevant code and/or commands).

Expected behavior
Need to update the query to conclude the remaining patterns. The query name can remain the same.

Additional context
Add any other context about the problem here.

@rajlearner17 rajlearner17 added the bug Something isn't working label Sep 21, 2021
@rajlearner17 rajlearner17 self-assigned this Sep 21, 2021
@rajlearner17 rajlearner17 linked a pull request Sep 21, 2021 that will close this issue
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant