diff --git a/rules/cloud/azure/azure_app_credential_added.yml b/rules/cloud/azure/azure_app_credential_added.yml index f5a0e30d1..a4af21c20 100644 --- a/rules/cloud/azure/azure_app_credential_added.yml +++ b/rules/cloud/azure/azure_app_credential_added.yml @@ -13,7 +13,7 @@ detection: properties.message: - Update Application-Certificates and secrets management - Update Service principal/Update Application - condition: 1 of selection + condition: selection falsepositives: - When credentials are added/removed as part of the normal working hours/workflows level: High