admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update o365_email_transport_rule_changed.yml

Browse Source
This commit is contained in:
Steven Dick
2025-01-31 14:58:01 -05:00
committed by GitHub
parent 4bd74d8606
commit ffc64431b7
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/o365_email_transport_rule_changed.yml
+2 -1
View File
@@ -9,7 +9,8 @@ description: The following analytic identifies when a user with sufficient acces
data_source:
- O365
search: '`o365_management_activity` Workload=Exchange AND Operation IN ("Set-*","Disable-*","New-*","Remove-*") AND Operation="*TransportRule"
| eval object_name = case('Parameters{}.Name'=="Name",mvindex('Parameters{}.Value',mvfind('Parameters{}.Name',"^Name$")),true(),ObjectId), object_id = case('Parameters{}.Name'=="Identity",mvindex('Parameters{}.Value',mvfind('Parameters{}.Name',"^Identity$")),true(),Id)
| rename Parameters{}.* as Parameters_*
| eval object_name = case(Parameters_Name=="Name",mvindex(Parameters_Value,mvfind(Parameters_Name,"^Name$")),true(),ObjectId), object_id = case(Parameters_Name=="Identity",mvindex(Parameters_Value,mvfind(Parameters_Name,"^Identity$")),true(),Id)
| stats values(object_name) as object_name, min(_time) as firstTime, max(_time) as lastTime, count by object_id, UserId, Operation
| rename UserId as user, Operation as signature
| `security_content_ctime(firstTime)`