Merge pull request #708 from wazuh/3.13-integration-gcp

Update gcp rules to look for integration: gcp
wazuh · Jun 16, 2020 · 634ca39 · 634ca39
2 parents f389b13 + cdccd69
commit 634ca39
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/rules/0690-gcp_rules.xml b/rules/0690-gcp_rules.xml
@@ -12,8 +12,8 @@ ID: 65000 - 65499
     <!-- GCP wodle -->
     <rule id="65000" level="0">
         <decoded_as>json</decoded_as>
-        <field name="gcp.resource.labels.project_id">\.+</field>
-        <description>Google Cloud Pub/Sub alert</description>
+        <field name="integration">gcp</field>
+        <description>GCP alert.</description>
         <options>no_full_log</options>
     </rule>