bug updates

bin/generate.py

@@ -95,7 +95,7 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
             if len(nes_fields) > 0:
                 detection['nes_fields'] = nes_fields
 
-        keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'security_domain', 'asset_type', 'risk_object', 'risk_object_type', 'risk_score']
+        keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist']
         mappings = {}
         for key in keys:
             if key == 'mitre_attack':

bin/jinja2_templates/savedsearches.j2

@@ -41,7 +41,6 @@ action.escu.providing_technologies = []
 {% endif %}
 {% if detection.tags.analytics_story is defined %}
 action.escu.analytic_story = {{ detection.tags.analytics_story | tojson }}
-
 {% if detection.tags.risk_object is defined %}
 action.risk = 1
 action.risk.param._risk_object = {{ detection.tags.risk_object }}
@@ -49,8 +48,6 @@ action.risk.param._risk_object_type = {{ detection.tags.risk_object_type }}
 action.risk.param._risk_score = {{ detection.tags.risk_score }}
 action.risk.param.verbose = 0
 {% endif %}
-
-
 {% else %}
 action.escu.analytic_story = []
 {% endif %}

detections/abnormally_high_aws_instances_launched_by_user.yml

@@ -37,3 +37,6 @@ tags:
   - DE.AE
   security_domain: network
   asset_type: AWS Instance
+  risk_object: userName
+  risk_object_type: user
+  risk_score: 50