Give sid 5007209 the condition its json_contains was meant to be

[NRGLine4Sec]

The rule reads

json_meta_content:! ".Operation", MCAS_ALERT_ANUBIS_DETECTION_NEW_COUNTRY,...
json_contains: ".Operation", "MCAS_ALERT";

and json_contains takes no arguments. rules.c line 2222 reads the keyword, discards what follows with a strtok_r, and sets the substring flag on the last json_content. The key and the value on that line are therefore dropped, and since the rule has no json_content at all, nothing carries the condition.

What remains is the exclusion list alone, so the rule alerts on every MCAS operation that is not one of the twenty it names. It is called "Possible Unknown MCAS Alert" and it fires on ordinary activity.

Measured against Sagan built from 3b9b0fa, one event per row:

.Operation ships patched
MCAS_ALERT_ANUBIS_DETECTION_NEW... silent silent
MCAS_ALERT_SOMETHING_NEW alert alert
FileUploaded alert silent
UserLoggedIn alert silent

The second row is the detection the rule is named for and it is kept. The last two are what it should never have alerted on.

The fix writes the test as a json_content with the modifier after it, which is the spelling the rest of the corpus uses: 616 other json_contains carry no arguments.

rev incremented.