Samirbous 461e72cf9c [Tuning] Suspicious Microsoft 365 Mail Access by ClientAppId (#3685) ...

* Update initial_access_microsoft_365_abnormal_clientappid.toml

* Update initial_access_microsoft_365_abnormal_clientappid.toml

* Update initial_access_microsoft_365_abnormal_clientappid.toml

---------

Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>

(cherry picked from commit cd716e5248)

2024-07-05 04:49:50 +00:00

..

aws

[New Rule] AWS RDS DB Instance Made Public (#3836)

2024-07-03 05:04:37 +00:00

azure

[New Rule] Entra ID Device Code Auth with Broker Client (#3819)

2024-07-01 14:34:42 +00:00

beaconing

Add exceptions to C2 Beaconing Activity (#3771)

2024-06-11 13:17:09 +00:00

cloud_defend

Back-porting Version Trimming (#3704)

2024-05-22 19:18:10 +00:00

cyberarkpas

Back-porting Version Trimming (#3704)

2024-05-22 19:18:10 +00:00

ded

Update rule setup instructions for UEBA packages (#3652)

2024-05-28 19:24:45 +00:00

dga

Remove unwanted backticks (#3724)

2024-05-31 16:19:24 +00:00

endpoint

Back-porting Version Trimming (#3704)

2024-05-22 19:18:10 +00:00

fim

Update FIM integration Setup sequence (#3781)

2024-06-12 11:14:29 +00:00

gcp

Back-porting Version Trimming (#3704)

2024-05-22 19:18:10 +00:00

github

Back-porting Version Trimming (#3704)

2024-05-22 19:18:10 +00:00

google_workspace

[Rule Tuning] Tuning Google Workspace Rules and File Name Length Reduction (#3849)

2024-07-01 19:53:27 +00:00

kubernetes

Back-porting Version Trimming (#3704)

2024-05-22 19:18:10 +00:00

lmd

Update rule setup instructions for UEBA packages (#3652)

2024-05-28 19:24:45 +00:00

o365

[Tuning] Suspicious Microsoft 365 Mail Access by ClientAppId (#3685)

2024-07-05 04:49:50 +00:00

okta

[Rule Tuning] Multiple Device Token Hashes for Single Okta Session (#3814)

2024-06-28 17:02:28 +00:00

problemchild

Remove unwanted backticks (#3724)

2024-05-31 16:19:24 +00:00