admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

dev_ops_uc

Browse Source
This commit is contained in:
tccontre
2021-08-19 12:08:22 +02:00
parent ceb9c848a2
commit c7b6dfd9f3
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/gsuite_email_suspicious_attachment.yml
+1 -1
View File
@@ -15,7 +15,7 @@ search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb",
destination{}.service num_message_attachments subject destination{}.address source.address
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `gsuite_suspicious_attachment_filter`'
| `gsuite_email_suspicious_attachment_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc.