Terrance DeJesus c7d21729d4 [New Rule] Google Workspace Login from Atypical ASN (#6146) ...

* new rule: Google Workspace User Login from Atypical ASN

* expanding mitre mapping

* tag updates

* added event.provider

* adding Google Workspace Token logs to this scope

* Apply suggestion from @terrancedejesus

* Apply suggestion from @terrancedejesus

* Apply suggestion from @terrancedejesus

* Apply suggestion from @imays11

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* Apply suggestion from @imays11

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

* adjusted name

* fixing query

---------

Co-authored-by: Isai <59296946+imays11@users.noreply.github.com>

(cherry picked from commit f40f08af3c)

2026-05-22 17:48:30 +00:00

..

aws

[New] AWS EKS Control Plane Logging Disabled (#6100)

2026-05-18 13:16:12 +00:00

aws_bedrock

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296)

2025-11-11 07:37:40 +05:30

azure

[Rule Tuning] ES|QL Explicit Null Value Removal (#6177)

2026-05-21 20:26:42 +00:00

azure_openai

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151)

2025-09-30 00:36:29 -04:00

beaconing

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 09:12:42 -05:00

cloud_defend

[New] Container Runtime CLI Execution with Suspicious Arguments (#6009)

2026-05-05 21:54:56 +00:00

cyberarkpas

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

ded

Add Entity related integrations ML rules with _ea job IDs and min_stack_version 9.4.0 (#5909)

2026-04-22 17:36:35 +05:30

dga

Add Entity related integrations ML rules with _ea job IDs and min_stack_version 9.4.0 (#5909)

2026-04-22 17:36:35 +05:30

endpoint

Prep 8.19/9.1 (#4869)

2025-07-07 11:27:48 -04:00

fim

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

gcp

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

github

Field not supported in integration (#6131)

2026-05-13 12:24:50 +00:00

google_workspace

[New Rule] Google Workspace Login from Atypical ASN (#6146)

2026-05-22 17:48:30 +00:00

kubernetes

[New] Kubernetes API Request Impersonating Privileged Identity (#6085)

2026-05-18 11:28:10 +00:00

lmd

Add Entity related integrations ML rules with _ea job IDs and min_stack_version 9.4.0 (#5909)

2026-04-22 17:36:35 +05:30

microsoft_exchange_online_message_trace

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 12:27:52 -04:00

o365

[Rule Tuning] Add Highlighted/Investigative Fields to M365 SharePoint Site Sharing Policy Weakened (#6157)

2026-05-21 19:58:30 +00:00

okta

[Rule Tuning] Revert Event Dataset for Security Alert Index (#5994)

2026-04-28 17:21:11 +00:00

pad

Add Entity related integrations ML rules with _ea job IDs and min_stack_version 9.4.0 (#5909)

2026-04-22 17:36:35 +05:30

problemchild

Update integrations list for problemchild detection rules (#6152)

2026-05-15 18:10:11 +00:00