Moving rule to discovery + creating insight (#854)

sublime-security · Oct 11, 2023 · 68f430f · 68f430f
1 parent 595aa7b
commit 68f430f
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/...ion_recipient_sld_in_sender_local_fts.yml → ...ion_recipient_sld_in_sender_local_fts.yml b/...ion_recipient_sld_in_sender_local_fts.yml → ...ion_recipient_sld_in_sender_local_fts.yml
diff --git a/insights/sender/recipient_sld_in_sender_local.yml b/insights/sender/recipient_sld_in_sender_local.yml
@@ -0,0 +1,14 @@
+name: "Recipient SLD in sender's email address local part"
+description: |
+  The sender's email address local part contains the recipient's SLD.
+type: "query"
+source: |
+  type.inbound
+  and any(recipients.to,
+        (
+          strings.contains(sender.email.local_part, .email.domain.sld)
+          // checking to ensure no FPs, like "me" in "me.com"
+          and length(.email.domain.sld) > 3
+        )
+    )
+severity: "medium"