Sagan medium stable other

[MICROSOFT-ATP] Collection alert

[MICROSOFT-ATP] Collection alert

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[MICROSOFT-ATP] Collection alert"; json_content: ".category", "Collection"; json_contains; json_map: "flow_id", ".id"; json_map: "username", ".relatedUser.userName"; classtype: suspicious-traffic; sid:5005687; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...