Panther informational experimental python

Suspicious is_suspicious tag

GSuite reported a suspicious activity for this user.

View Source

Detection Logic

def rule(event):
    return event.deep_get("parameters", "is_suspicious") is True


def title(event):
    user = event.deep_get("actor", "email", default="<UNKNOWN_USER>")
    return f"A suspicious action was reported for user [{user}]"

Field Validations

Loading…

Comments (0)

Loading comments...