contentctl
contentctl copied to clipboard
The "User Name" type should map to a "user" risk object and not "other"
- In
detection_abstract.pywe look for observable of typeusername - In practice, the valid type (see
SES_OBSERVABLE_TYPE_MAPPING) isUser Name;Username/usernameis invalid and static validation does not allwo for these values - This is causing a handful of detections to create risk objects of type
otherinstead of typeuser - Additionally,
deviceis not a valid observable type perSES_OBSERVABLE_TYPE_MAPPING(used in validation)