Link Search Menu Expand Document

Zoom

ID: 100142

Description:

Repository: Group: Zoom Type: event

Default Status:

Disabled

Tags:
 

Selector:

Query:

(@event_type:@zoom)

Filters:

Field MUST hit
   
Field MUST NOT hit
   

Behavior Rule:

Key Type Behavior Category
@zoom.user.email username  

Risks:

Risks Base Score Dimension
     

Attributes:

Alias Key
timezone @zoom.user.timezone
username @zoom.user.email

Correlation Rules:

First Occurrence:

Name Window Fields
NewTimezone 10 days @zoom.user.timezone

Aggregation:

Name Window Field AggType Match
multipleZones 30 minutes @zoom.user.timezone cardinality gt 1

History:

User Date
ch*s@fluencysecurity.com 2020 Dec 4 15:05:54 EST

This page was automatically created/formatted on Tue, 2021 Oct 19 00:29:17 EDT, from rule_dump.json (db47c470500ce8686ead334f5eda0596)