admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' into dependabot/pip/boto3-1.17.74

Browse Source
This commit is contained in:
P4T12ICK
2021-05-18 13:30:06 +02:00
committed by GitHub
parent 9cf073b083 bbd3be391b
commit d02aa826bf
4 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/o365_pst_export_alert.yml
+1
View File
@@ -21,6 +21,7 @@ references:
tags:
analytic_story:
- Office 365 Detections
- Data Exfiltration
asset_type: Office 365
automated_detection_testing: passed
dataset:
detections/cloud/o365_suspicious_admin_email_forwarding.yml
+1
View File
@@ -19,6 +19,7 @@ references: []
tags:
analytic_story:
- Office 365 Detections
- Data Exfiltration
asset_type: Office 365
automated_detection_testing: passed
cis20:
detections/cloud/o365_suspicious_user_email_forwarding.yml
+1
View File
@@ -19,6 +19,7 @@ references: []
tags:
analytic_story:
- Office 365 Detections
- Data Exfiltration
asset_type: Office 365
automated_detection_testing: passed
cis20:
tests/cloud/o365_suspicious_user_email_forwarding.test.yml
+12
View File
@@ -0,0 +1,12 @@
name: O365 Suspicious User Email Forwarding Unit Test
tests:
- name: O365 Suspicious User Email Forwarding
file: cloud/o365_suspicious_user_email_forwarding.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: o365_email_forwarding_rule.json
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.003/o365_email_forwarding_rule/o365_email_forwarding_rule.json
sourcetype: 'o365:management:activity'
source: 'o365'