Sagan medium stable other

[MICROSOFT-ATP] Discovery alert

[MICROSOFT-ATP] Discovery alert

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[MICROSOFT-ATP] Discovery alert"; json_content: ".category", "Discovery"; json_contains; json_map: "flow_id", ".id"; json_map: "username", ".relatedUser.userName"; classtype: suspicious-traffic; sid:5005691; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...