Small problem: https://github.com/elastic/detection-rules/blob/main/rules/integrations/aws/execution_new_terms_cloudformation_createstack.toml The text on line 10 should read AWS Cloudformation, not AWS Cloudwatch