risk validation

bin/validate.py

@@ -134,17 +134,17 @@ def validate_standard_fields(object, uuids):
                 if not isinstance(v, int):
                     errors.append("ERROR: risk_score not integer value for object: %s" % v)  
             risk_object_type = ["user","system", "other"]
+
             if k == 'risk_object_type':
-                if not any(s in v for s in risk_object_type):
-                    errors.append("ERROR: risk_object_type can only contain  user,system, other: %s" % v) 
+                if v not in risk_object_type:
+                    errors.append("ERROR: risk_object_type can only contain user, system, other: %s" % v) 
+
             if k == 'risk_object':
                 try:
                     v.encode('ascii')
                 except UnicodeEncodeError:
                     errors.append("ERROR: risk_object not ascii for object: %s" % v)
 
-
-
     return errors, uuids
 
 

detections/abnormally_high_aws_instances_launched_by_user.yml

@@ -37,3 +37,6 @@ tags:
   - DE.AE
   security_domain: network
   asset_type: AWS Instance
+  risk_score: 40
+  risk_object_type: user
+  risk_object: userName