Sublime Security high experimental mql

beta.DLP: Crypto Wallet Address

Detects messages containing cryptocurrency wallet addresses.

View Source

Detection Logic

type.outbound
and (
  any(beta.ml_extract_sensitive_information(body.current_thread.text).elements,
    .type == "crypto_wallet_address" and .confidence in ("medium", "high")
  )
  or any(beta.ml_extract_sensitive_information(subject.subject).elements,
    .type == "crypto_wallet_address" and .confidence in ("medium", "high")
  )
  or any(attachments,
  any(file.explode(.),
    (
      any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements,
        .type == "crypto_wallet_address" and .confidence in ("medium", "high")
      )
      or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements,
        .type == "crypto_wallet_address" and .confidence in ("medium", "high")
      )
    )
  )
)
)

Field Validations

Loading…

Comments (0)

Loading comments...