fix List values must be strings or numbers (46)

rules/web/web_fortinet_cve_2021_22123_exploit.yml

@@ -6,6 +6,7 @@ references:
     - https://www.rapid7.com/blog/post/2021/08/17/fortinet-fortiweb-os-command-injection
 author: Bhabesh Raj, Florian Roth
 date: 2021/08/19
+modified: 2021/08/29
 tags:
     - attack.initial_access
     - attack.t1190
@@ -13,15 +14,12 @@ logsource:
     category: webserver
 detection:
     selection:
-        c-uri|contains: 
-            - '/api/v2.0/user/remoteserver.saml'
-        cs-method:
-            - POST
+        c-uri|contains: '/api/v2.0/user/remoteserver.saml'
+        cs-method: POST
     filter1:
         cs-referer|contains: '/root/user/remote-user/saml-user/'
     filter2:
-        cs-referer:
-            - null
+        cs-referer: null
     condition: selection and not filter1 and not filter2
 fields:
     - client_ip