SCC_Mail_Flow
ID: 100244
Description:
Security Compliance Center mail flow
Repository: Group: SCC Type: event
Default Status:
Enabled
| Tags: | ||
|---|---|---|
| SCC | SecurityComplianceCenter | Office365 |
Selector:
Query:
Filters:
| Field | MUST hit |
|---|---|
| @source | Audit.General |
| @fields.Workload | SecurityComplianceCenter |
| @fields.Category | MailFlow |
| Field | MUST NOT hit |
|---|---|
Behavior Rule:
| Key | Type | Behavior Category |
|---|---|---|
| @fields.InsightData.Details.Name | username | application activity |
Risks:
| Risks | Base Score | Dimension |
|---|---|---|
| Timeline | 0 | - |
Attributes:
| Alias | Key |
|---|---|
| Category | @fields.Category |
| InsightDescription | @fields.Description |
| InsightValue | @fields.AdditionalData.Value |
| Operation | @fields.Operation |
| Username | @fields.InsightData.Details.Name |
| RecordType | @fields.RecordType |
| UserType | @fields.UserType |
| Severity | @fields.Severity |
| Customer | @customer |
Correlation Rules:
History:
| User | Date |
|---|---|
| em*n@fluencysecurity.com | 2021 Jan 7 18:59:03 EST |
| em*n@fluencysecurity.com | 2021 Jan 11 04:52:05 EST |
| em*n@fluencysecurity.com | 2021 Jan 11 04:57:54 EST |
| em*n@fluencysecurity.com | 2021 Feb 8 14:12:34 EST |
| al*r@fluencysecurity.com | 2021 Feb 18 11:43:11 EST |
This page was automatically created/formatted on Wed, 2022 May 4 21:43:53 EDT, from rule_dump.json (4d88bffdfb1cea26b3985f2193033606)