Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Rule Tuning] External User Added to Google Workspace Group #4128

Open
brokensound77 opened this issue Oct 2, 2024 · 0 comments
Open

[Rule Tuning] External User Added to Google Workspace Group #4128

brokensound77 opened this issue Oct 2, 2024 · 0 comments
Labels
Integration: Google Workspace Rule: Tuning tweaking or tuning an existing rule Team: TRADE

Comments

@brokensound77
Copy link
Contributor

Link to Rule

detection-rules/rules/integrations/google_workspace/initial_access_external_user_added_to_google_workspace_group.toml

Line 87 in 51859e5

rule_id = "38f384e0-aef8-11ed-9a38-f661ea17fbcc"

Rule Tuning Type

False Negatives - Enhancing detection of true threats that were previously missed.

Description

Tune event.action to include GROUP_MEMBER_BULK_UPLOAD in addition to the existing ADD_GROUP_MEMBER

Example Data

No response
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Integration: Google Workspace Rule: Tuning tweaking or tuning an existing rule Team: TRADE
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@brokensound77