search

GoogleCloudPlatform / security-analytics

Community Security Analytics provides a set of community-driven audit & threat queries for Google Cloud
Apache License 2.0
326 stars 69 forks source link

Incorrect use of operator OR in file #37

Closed tszebeni closed 1 year ago

tszebeni commented 1 year ago

Dear repo maintainers, while I was investigating the queries for log analytics, I found that there is an error in file: https://github.com/GoogleCloudPlatform/security-analytics/blob/4e139fe1ac21745dcf4cf9c0f942dedda0c83817/backends/log_analytics/sql/1_30_console_accesses.sql#L34 comma needs to be used instead of an OR, within parentheses of operator IN. That way the query succeeds, otherwise syntax error is given.

rarsan commented 1 year ago

Thanks for reporting this @tszebeni ! There's a fix in-flight for this as part of the larger PR #35 . That PR should be merged this week. Alternatively, feel free to submit a hotfix PR for this and I can review/approve promptly.

Appreciate your feedback and any other security use case you might be interested in.

rarsan commented 1 year ago

Keeping this open for now until fix is in.

rarsan commented 1 year ago

Fixed with now-merged PR #35 (commit)