[BUG] Detector Generated False Findings For Rule "Publicly Accessible RDP Service"

[jowg-amazon]

What is the bug?
A detector will generate false findings for the rule "Publicly Accessible RDP Service" if id.orig_h is not mapped to a field.

This is occurring because the rule is based on a not selection so if the field is not mapped to anything, the rule will be triggered.

How can one reproduce the bug?

1. Create a network detector
2. Select "Publicly Accessible RDP Service" as the rule but do not map the field id.orig_h
3. Insert a document into the index and a finding will be triggered

What is the expected behavior?
If the field is not mapped this rule should not be applied/generate findings.

What is your host/environment?

• OS 2.11

[jowg-amazon]

Issue was fixed in this PR by adding an exists check in the query:
#852