mirror of
https://github.com/elastic/detection-rules
synced 2026-06-08 14:00:08 +00:00
Isai
f6b0a96615
* [Rule Tunings] GWS Rule Tunings (small changes)
Small changes to the following rules. All are performing as expected in telemetry, no major query changes needed.
### ALL
- made index more specific `logs-google_workspace.admin*`
- updated tags to include additional MITRE mapping
- removed any unnecessary query filters, opting for only `data_stream.dataset` and `google_workspace.event.type`
- added highlighted fields
**I've kept the long `from` window to account for the 2 hour default lag time used by Filebeat, we've submitted a request to change this and will change our default rule settings when this changes.**
### External User Added to Google Workspace Group
- changed the query to compare the shorter field `user.target.domain` vs the longer field `user.target.email`. Essentially the same comparison is being made just with a smaller field. Screenshot below shows the still working query.
Tested all the Rules manually, test data is in our shared stack.
* remove unnecessary fields
(cherry picked from commit fde5a26d35)