GoogleCloudPlatform/security-analytics

Incorrect use of operator OR in file

Closed this issue · 3 comments

Dear repo maintainers,
while I was investigating the queries for log analytics, I found that there is an error in file:

AND proto_payload.audit_log.method_name IN ("GetProject" OR "FindOrCreateOrganization")

comma needs to be used instead of an OR, within parentheses of operator IN.
That way the query succeeds, otherwise syntax error is given.

rarsan commented

Thanks for reporting this @tszebeni ! There's a fix in-flight for this as part of the larger PR #35 . That PR should be merged this week. Alternatively, feel free to submit a hotfix PR for this and I can review/approve promptly.

Appreciate your feedback and any other security use case you might be interested in.

rarsan commented

Keeping this open for now until fix is in.

rarsan commented

Fixed with now-merged PR #35 (commit)