Change negative alert case to positive for cloudtrail deadman alert
Change negative alert case to positive for cloudtrail deadman alert

gdestuynder/MozDef,mozilla/MozDef,mpurzynski/MozDef,Phrozyn/MozDef,gdestuynder/MozDef,Phrozyn/MozDef,jeffbryner/MozDef,mpurzynski/MozDef,gdestuynder/MozDef,mozilla/MozDef,jeffbryner/MozDef,jeffbryner/MozDef,jeffbryner/MozDef,Phrozyn/MozDef,gdestuynder/MozDef,mpurzynski/MozDef,mozilla/MozDef,mpurzynski/MozDef,mozilla/MozDef,Phrozyn/MozDef