Elastic high stable kql
Threat Intel Email Indicator Match
This rule is triggered when an email indicator from the Threat Intel Filebeat module or integrations matches an event containing email-related data, such as logs from email security gateways or email service providers.
Detection Logic
email.from.address:* or email.sender.address:* or email.reply_to.address:* or email.to.address:*Field Validations
Loading…
Comments (0)
Loading comments...