[Rule Tuning] External User Added to Google Workspace Group

[brokensound77]

Link to Rule

detection-rules/rules/integrations/google_workspace/initial_access_external_user_added_to_google_workspace_group.toml

Line 87 in 51859e5

rule_id = "38f384e0-aef8-11ed-9a38-f661ea17fbcc"

Rule Tuning Type

False Negatives - Enhancing detection of true threats that were previously missed.

Description

Tune event.action to include GROUP_MEMBER_BULK_UPLOAD in addition to the existing ADD_GROUP_MEMBER

Example Data

No response

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.