sublimemediumRule

Fuzzy Attack Score: Advanced Graymail Detection

Exercises the beta.fuzzy_attack_score() function. Flags on Graymail verdicts.

Detection Query

type.inbound
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and beta.fuzzy_attack_score().verdict == "graymail"

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Fuzzy Attack Score: Advanced Graymail Detection"
description: "Exercises the beta.fuzzy_attack_score() function. Flags on Graymail verdicts."
type: "rule"
severity: "medium"
source: |
  type.inbound
  //
  // This rule makes use of a beta feature and is subject to change without notice
  // using the beta feature in custom rules is not suggested until it has been formally released
  //
  and beta.fuzzy_attack_score().verdict == "graymail"
id: "f83b83bc-039b-4025-be85-78a36ffabf6e"