Sublime Security unknown experimental mql

Attachment: Any EML file

Any EML attachment. This rule can be combined with a webhook action for further analysis of attached EML files, eg via the analysis API.

View Source

Detection Logic

type.inbound
and any(attachments, .file_extension =~ 'eml')

Field Validations

Loading…

Comments (0)

Loading comments...