Back-porting Version Trimming (#3704)

rules/integrations/github/execution_github_app_deleted.toml

@@ -2,15 +2,11 @@
 creation_date = "2023/10/11"
 integration = ["github"]
 maturity = "production"
-min_stack_comments = "New fields added: required_fields, related_integrations, setup"
-min_stack_version = "8.3.0"
-updated_date = "2023/10/11"
+updated_date = "2024/05/21"
 
 [rule]
 author = ["Elastic"]
-description = """
-Detects the deletion of a GitHub app either from a repo or an organization.
-"""
+description = "Detects the deletion of a GitHub app either from a repo or an organization.\n"
 from = "now-9m"
 index = ["logs-github.audit-*"]
 language = "eql"
@@ -19,11 +15,7 @@ name = "GitHub App Deleted"
 risk_score = 21
 rule_id = "fd01b949-81be-46d5-bcf8-284395d5f56d"
 severity = "low"
-tags = ["Domain: Cloud",
-        "Use Case: Threat Detection",
-        "Tactic: Execution",
-        "Data Source: Github"
-        ]
+tags = ["Domain: Cloud", "Use Case: Threat Detection", "Tactic: Execution", "Data Source: Github"]
 timestamp_override = "event.ingested"
 type = "eql"
 
@@ -31,6 +23,7 @@ query = '''
 configuration where event.dataset == "github.audit" and github.category == "integration_installation" and event.type == "deletion"
 '''
 
+
 [[rule.threat]]
 framework = "MITRE ATT&CK"
 [[rule.threat.technique]]
@@ -43,3 +36,4 @@ reference = "https://attack.mitre.org/techniques/T1648/"
 id = "TA0002"
 name = "Execution"
 reference = "https://attack.mitre.org/tactics/TA0002/"
+