From cc10e6150e833944bab845903d55feaeec0421b5 Mon Sep 17 00:00:00 2001
From: matteopasa <matteo.pasina@sysdig.com>
Date: Fri, 16 Feb 2024 11:23:46 +0100
Subject: [PATCH] fix s3.cnt.other condition

Signed-off-by: matteopasa <matteo.pasina@sysdig.com>
---
 plugins/cloudtrail/pkg/cloudtrail/extract.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/plugins/cloudtrail/pkg/cloudtrail/extract.go b/plugins/cloudtrail/pkg/cloudtrail/extract.go
index fbcb5ef6..6def2203 100644
--- a/plugins/cloudtrail/pkg/cloudtrail/extract.go
+++ b/plugins/cloudtrail/pkg/cloudtrail/extract.go
@@ -627,9 +627,9 @@ func getfieldU64(jdata *fastjson.Value, field string) (bool, uint64) {
 			ename = string(jdata.GetStringBytes("detail", "reason"))
 		}
 		if ename == "GetObject" || ename == "PutObject" {
-			return true, 1
+			return false, 0
 		}
-		return false, 0
+		return true, 1
 	default:
 		return false, 0
 	}