From c7b6dfd9f34edb6cbf400a711333f40f0c20e50b Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 19 Aug 2021 12:08:22 +0200 Subject: [PATCH] dev_ops_uc --- detections/endpoint/gsuite_email_suspicious_attachment.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/gsuite_email_suspicious_attachment.yml b/detections/endpoint/gsuite_email_suspicious_attachment.yml index 6271b98ec8..672cb53919 100644 --- a/detections/endpoint/gsuite_email_suspicious_attachment.yml +++ b/detections/endpoint/gsuite_email_suspicious_attachment.yml @@ -15,7 +15,7 @@ search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", destination{}.service num_message_attachments subject destination{}.address source.address | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `gsuite_suspicious_attachment_filter`' + | `gsuite_email_suspicious_attachment_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.