admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

dev_sec2

Browse Source
This commit is contained in:
tccontre
2021-08-23 20:08:35 +02:00
parent d831d8b84a
commit 90850700d2
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml
+1 -1
View File
@@ -11,7 +11,7 @@ search: '`gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*tel
| rex field=source.from_header_address "[^@]+@(?<source_domain>[^@]+)"
| rex field=destination{}.address "[^@]+@(?<dest_domain>[^@]+)"
| where not source_domain="internal_test_email.com" and dest_domain="internal_test_email.com"
|stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address src_user subject destination{}.address
|stats values(link_domain{}) as link_domains min(_time) as firstTime max(_time) as lastTime count by is_spam source.address source.from_header_address subject destination{}.address
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `gsuite_email_with_known_abuse_web_service_link_filter`'