The alarm should trigger if it finds at least one instance of the filtered text, not zero or more instances. Thus it needs to be > 0.
I have passed this on to the ACG team to review.
I would recommend instead of using >0, use >=1 per the AWS CIS Benchmarks.
Psst…this one if you’ve been moved to ACG!
I agree, it was watching the video and stopped to understand why they were using >=0, then I continued just to hear Ryan’s frustration, business as usual