Skip to content

Commit a5e20cf

Browse files
authored
T1114 o365_suspect_email_actions: add Graph message trace fixture (#1224)
1 parent 344360c commit a5e20cf

2 files changed

Lines changed: 8 additions & 1 deletion

File tree

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
version https://git-lfs.github.com/spec/v1
2+
oid sha256:2d0a6bbfdb7d44cc4b9fafc369c108e339a6c10f31de0b4261584abf99de84ee
3+
size 1716

‎datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_suspect_email_actions.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,11 @@ mitre_technique:
99
datasets:
1010
- name: o365_messagetrace_suspect_events
1111
path: /datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_messagetrace_suspect_events.log
12-
sourcetype: o365:management:activity
12+
sourcetype: o365:reporting:messagetrace
13+
source: o365
14+
- name: o365_graph_messagetrace_suspect_events
15+
path: /datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log
16+
sourcetype: o365:graph:messagetrace
1317
source: o365
1418
- name: o365_exchange_suspect_events
1519
path: /datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log

0 commit comments

Comments
 (0)