old_contents: #!/usr/bin/env python
  
  # This Source Code Form is subject to the terms of the Mozilla Public
  # License, v. 2.0. If a copy of the MPL was not distributed with this
  # file, You can obtain one at http://mozilla.org/MPL/2.0/.
  # Copyright (c) 2014 Mozilla Corporation
  #
  # Contributors:
  # Anthony Verez averez@mozilla.com
  
  from lib.alerttask import AlertTask
  from query_models import SearchQuery, TermMatch, TermsFilter
  
  
  class AlertCloudtrail(AlertTask):
      def main(self):
          search_query = SearchQuery(hours=1)
  
          search_query.add_must([
              TermMatch('_type', 'cloudtrail'),
              TermsFilter('eventName', ['runinstances',
                                        'stopinstances',
                                        'startinstances'])
          ])
  
          self.filtersManual(search_query)
          # Search events
          self.searchEventsSimple()
          self.walkEvents()
  
      # Set alert properties
      def onEvent(self, event):
          category = 'AWSCloudtrail'
          tags = ['cloudtrail', 'aws']
          severity = 'INFO'
  
          summary = ('{0} called {1} from {2}'.format(event['_source']['userIdentity'][
                     'userName'], event['_source']['eventName'], event['_source']['sourceIPAddress']))
          if event['_source']['eventName'] == 'RunInstances':
              for i in event['_source']['responseElements']['instancesSet']['items']:
                  if 'privateDnsName' in i.keys():
                      summary += (' running {0} '.format(i['privateDnsName']))
                  elif 'instanceId' in i.keys():
                      summary += (' running {0} '.format(i['instanceId']))
                  else:
                      summary += (' running {0} '.format(flattenDict(i)))
          if event['_source']['eventName'] == 'StartInstances':
              for i in event['_source']['requestParameters']['instancesSet']['items']:
                  summary += (' starting {0} '.format(i['instanceId']))
  
          # Create the alert object based on these properties
          return self.createAlertDict(summary, category, tags, [event], severity)
  
new_contents: #!/usr/bin/env python
  
  # This Source Code Form is subject to the terms of the Mozilla Public
  # License, v. 2.0. If a copy of the MPL was not distributed with this
  # file, You can obtain one at http://mozilla.org/MPL/2.0/.
  # Copyright (c) 2014 Mozilla Corporation
  #
  # Contributors:
  # Anthony Verez averez@mozilla.com
  
  from lib.alerttask import AlertTask
  from query_models import SearchQuery, TermMatch, TermsMatch
  
  
  class AlertCloudtrail(AlertTask):
      def main(self):
          search_query = SearchQuery(hours=1)
  
          search_query.add_must([
              TermMatch('_type', 'cloudtrail'),
              TermsMatch('eventName', ['runinstances',
                                        'stopinstances',
                                        'startinstances'])
          ])
  
          self.filtersManual(search_query)
          # Search events
          self.searchEventsSimple()
          self.walkEvents()
  
      # Set alert properties
      def onEvent(self, event):
          category = 'AWSCloudtrail'
          tags = ['cloudtrail', 'aws']
          severity = 'INFO'
  
          summary = ('{0} called {1} from {2}'.format(event['_source']['userIdentity'][
                     'userName'], event['_source']['eventName'], event['_source']['sourceIPAddress']))
          if event['_source']['eventName'] == 'RunInstances':
              for i in event['_source']['responseElements']['instancesSet']['items']:
                  if 'privateDnsName' in i.keys():
                      summary += (' running {0} '.format(i['privateDnsName']))
                  elif 'instanceId' in i.keys():
                      summary += (' running {0} '.format(i['instanceId']))
                  else:
                      summary += (' running {0} '.format(flattenDict(i)))
          if event['_source']['eventName'] == 'StartInstances':
              for i in event['_source']['requestParameters']['instancesSet']['items']:
                  summary += (' starting {0} '.format(i['instanceId']))
  
          # Create the alert object based on these properties
          return self.createAlertDict(summary, category, tags, [event], severity)
  
subject: Update TermsFilter to TermsMatch