* [Rule Tuning] SSM Session Started to EC2 Instance
Role/role session noise seen in telemetry due to new fields term using `aws.cloudtrail.user_identity.arn`, which is unique for each role session and does not isolate the role itself.
- new fields term change to `cloud.account.id` and `user.name` combination to account for both IAMUsers and Roles across multiple accounts.
- added AWS to the rule name
- reduced execution window
- small edits to description and IG
- added reference from IG to Reference section
* adding highlighted fields
* added EC2 tag
* Update lateral_movement_aws_ssm_start_session_to_ec2_instance.toml
* Apply suggestions from code review
Isai
7ff2648cfd