diff --git a/detection-rules/body_prompt_injection_llm_instructions_new_sender.yml b/detection-rules/body_prompt_injection_llm_instructions_new_sender.yml new file mode 100644 index 00000000000..4e637a73247 --- /dev/null +++ b/detection-rules/body_prompt_injection_llm_instructions_new_sender.yml @@ -0,0 +1,33 @@ +name: "Prompt injection: Body instructions directed at an LLM from a new sender" +description: "Detects messages whose plaintext body contains instructions directed at an LLM (prompt injection), sent from a sender with no established, benign relationship. Targets attacks that attempt to manipulate downstream AI assistants that process email on the recipient's behalf." +type: "rule" +severity: "high" +source: | + // + // This rule makes use of a beta feature and is subject to change without notice. + // Using the beta feature in custom rules is not suggested until it has been formally released. + // + type.inbound + and beta.prompt_injection_detection(body.plain.raw).detection == "injection" + and profile.by_sender().prevalence in ("new", "outlier", "rare") + and not profile.by_sender().any_messages_benign + + // Graymail exclusion (Fuzzy Attack Score), limited to authenticated senders + and not ( + beta.fuzzy_attack_score().verdict == "graymail" + and headers.auth_summary.dmarc.pass + ) + +tags: + - "Email prompt injection" +attack_types: + - "Credential Phishing" + - "BEC/Fraud" +tactics_and_techniques: + - "Social engineering" + - "Evasion" +detection_methods: + - "Content analysis" + - "Natural Language Understanding" + - "Sender analysis" +id: "eeba0baa-be61-55af-833b-9e2282119270" diff --git a/dlp-discovery-rules/beta_dlp_at_vat.yml b/dlp-discovery-rules/beta_dlp_at_vat.yml index 78c2c2f9c53..48ff5e8d1d7 100644 --- a/dlp-discovery-rules/beta_dlp_at_vat.yml +++ b/dlp-discovery-rules/beta_dlp_at_vat.yml @@ -15,22 +15,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "at_vat" and .confidence in ("medium", "high") + .type == "at_vat" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "at_vat" and .confidence in ("medium", "high") + .type == "at_vat" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "at_vat" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "at_vat" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "at_vat" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "at_vat" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_au_abn.yml b/dlp-discovery-rules/beta_dlp_au_abn.yml index b24e8a62057..22719d471da 100644 --- a/dlp-discovery-rules/beta_dlp_au_abn.yml +++ b/dlp-discovery-rules/beta_dlp_au_abn.yml @@ -15,22 +15,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "au_abn" and .confidence in ("medium", "high") + .type == "au_abn" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "au_abn" and .confidence in ("medium", "high") + .type == "au_abn" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "au_abn" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "au_abn" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "au_abn" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "au_abn" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_au_bank_account.yml b/dlp-discovery-rules/beta_dlp_au_bank_account.yml index 020bf0386c0..ac859d44485 100644 --- a/dlp-discovery-rules/beta_dlp_au_bank_account.yml +++ b/dlp-discovery-rules/beta_dlp_au_bank_account.yml @@ -15,22 +15,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "au_bank_account" and .confidence in ("medium", "high") + .type == "au_bank_account" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "au_bank_account" and .confidence in ("medium", "high") + .type == "au_bank_account" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "au_bank_account" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "au_bank_account" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "au_bank_account" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "au_bank_account" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_au_driver_license.yml b/dlp-discovery-rules/beta_dlp_au_driver_license.yml index cb8e5dce298..ee66a77ec5e 100644 --- a/dlp-discovery-rules/beta_dlp_au_driver_license.yml +++ b/dlp-discovery-rules/beta_dlp_au_driver_license.yml @@ -15,22 +15,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "au_driver_license" and .confidence in ("medium", "high") + .type == "au_driver_license" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "au_driver_license" and .confidence in ("medium", "high") + .type == "au_driver_license" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "au_driver_license" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "au_driver_license" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "au_driver_license" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "au_driver_license" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_au_medicare.yml b/dlp-discovery-rules/beta_dlp_au_medicare.yml index c9b7a2e4af2..6545b2f4bf7 100644 --- a/dlp-discovery-rules/beta_dlp_au_medicare.yml +++ b/dlp-discovery-rules/beta_dlp_au_medicare.yml @@ -15,22 +15,23 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "au_medicare" and .confidence in ("medium", "high") + .type == "au_medicare" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "au_medicare" and .confidence in ("medium", "high") + .type == "au_medicare" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "au_medicare" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "au_medicare" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "au_medicare" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "au_medicare" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_au_passport.yml b/dlp-discovery-rules/beta_dlp_au_passport.yml index 486f0842e89..a01a0b6f214 100644 --- a/dlp-discovery-rules/beta_dlp_au_passport.yml +++ b/dlp-discovery-rules/beta_dlp_au_passport.yml @@ -15,22 +15,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "au_passport_number" and .confidence in ("medium", "high") + .type == "au_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "au_passport_number" and .confidence in ("medium", "high") + .type == "au_passport_number" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "au_passport_number" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "au_passport_number" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "au_passport_number" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "au_passport_number" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_au_tfn.yml b/dlp-discovery-rules/beta_dlp_au_tfn.yml index 5c7bc2121f5..7a8caf64dd3 100644 --- a/dlp-discovery-rules/beta_dlp_au_tfn.yml +++ b/dlp-discovery-rules/beta_dlp_au_tfn.yml @@ -16,22 +16,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "au_tfn" and .confidence in ("medium", "high") + .type == "au_tfn" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "au_tfn" and .confidence in ("medium", "high") + .type == "au_tfn" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "au_tfn" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "au_tfn" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "au_tfn" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "au_tfn" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_aws_access_key.yml b/dlp-discovery-rules/beta_dlp_aws_access_key.yml index d8b51e20285..6c5294b3753 100644 --- a/dlp-discovery-rules/beta_dlp_aws_access_key.yml +++ b/dlp-discovery-rules/beta_dlp_aws_access_key.yml @@ -6,24 +6,26 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "aws_access_key" and .confidence in ("medium", "high") + .type == "aws_access_key" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "aws_access_key" and .confidence in ("medium", "high") + .type == "aws_access_key" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "aws_access_key" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "aws_access_key" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "aws_access_key" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "aws_access_key" + and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "Credentials" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_be_vat.yml b/dlp-discovery-rules/beta_dlp_be_vat.yml index 47f6a772f3e..26cf37d5add 100644 --- a/dlp-discovery-rules/beta_dlp_be_vat.yml +++ b/dlp-discovery-rules/beta_dlp_be_vat.yml @@ -15,22 +15,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "be_vat" and .confidence in ("medium", "high") + .type == "be_vat" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "be_vat" and .confidence in ("medium", "high") + .type == "be_vat" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "be_vat" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "be_vat" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "be_vat" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "be_vat" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_ca_bank_account.yml b/dlp-discovery-rules/beta_dlp_ca_bank_account.yml index 30442512660..5e8f34304b8 100644 --- a/dlp-discovery-rules/beta_dlp_ca_bank_account.yml +++ b/dlp-discovery-rules/beta_dlp_ca_bank_account.yml @@ -15,22 +15,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "ca_bank_account" and .confidence in ("medium", "high") + .type == "ca_bank_account" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "ca_bank_account" and .confidence in ("medium", "high") + .type == "ca_bank_account" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "ca_bank_account" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "ca_bank_account" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "ca_bank_account" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "ca_bank_account" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_ca_driver_license.yml b/dlp-discovery-rules/beta_dlp_ca_driver_license.yml index 05ce01344c4..b41b4bec252 100644 --- a/dlp-discovery-rules/beta_dlp_ca_driver_license.yml +++ b/dlp-discovery-rules/beta_dlp_ca_driver_license.yml @@ -16,22 +16,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "ca_driver_license" and .confidence in ("medium", "high") + .type == "ca_driver_license" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "ca_driver_license" and .confidence in ("medium", "high") + .type == "ca_driver_license" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "ca_driver_license" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "ca_driver_license" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "ca_driver_license" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "ca_driver_license" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_ca_health_service.yml b/dlp-discovery-rules/beta_dlp_ca_health_service.yml index bb26ef8efa9..bad372e5289 100644 --- a/dlp-discovery-rules/beta_dlp_ca_health_service.yml +++ b/dlp-discovery-rules/beta_dlp_ca_health_service.yml @@ -15,22 +15,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "ca_health_service" and .confidence in ("medium", "high") + .type == "ca_health_service" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "ca_health_service" and .confidence in ("medium", "high") + .type == "ca_health_service" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "ca_health_service" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "ca_health_service" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "ca_health_service" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "ca_health_service" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_ca_passport.yml b/dlp-discovery-rules/beta_dlp_ca_passport.yml index 442a6c4fb83..6ef454f40c4 100644 --- a/dlp-discovery-rules/beta_dlp_ca_passport.yml +++ b/dlp-discovery-rules/beta_dlp_ca_passport.yml @@ -16,22 +16,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "ca_passport_number" and .confidence in ("medium", "high") + .type == "ca_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "ca_passport_number" and .confidence in ("medium", "high") + .type == "ca_passport_number" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "ca_passport_number" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "ca_passport_number" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "ca_passport_number" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "ca_passport_number" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_ca_phin.yml b/dlp-discovery-rules/beta_dlp_ca_phin.yml index 716f4960e3e..90e2cdc90b6 100644 --- a/dlp-discovery-rules/beta_dlp_ca_phin.yml +++ b/dlp-discovery-rules/beta_dlp_ca_phin.yml @@ -15,22 +15,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "ca_phin" and .confidence in ("medium", "high") + .type == "ca_phin" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "ca_phin" and .confidence in ("medium", "high") + .type == "ca_phin" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "ca_phin" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "ca_phin" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "ca_phin" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "ca_phin" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_canadian_sin.yml b/dlp-discovery-rules/beta_dlp_canadian_sin.yml index 7f4d129b4f7..c4910c4d97a 100644 --- a/dlp-discovery-rules/beta_dlp_canadian_sin.yml +++ b/dlp-discovery-rules/beta_dlp_canadian_sin.yml @@ -6,24 +6,25 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "canadian_sin" and .confidence in ("medium", "high") + .type == "canadian_sin" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "canadian_sin" and .confidence in ("medium", "high") + .type == "canadian_sin" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "canadian_sin" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "canadian_sin" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "canadian_sin" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "canadian_sin" + and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "PII" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_clear_text_credentials_outbound.yml b/dlp-discovery-rules/beta_dlp_clear_text_credentials_outbound.yml index 10d7f4d15d2..8e27eea4ee1 100644 --- a/dlp-discovery-rules/beta_dlp_clear_text_credentials_outbound.yml +++ b/dlp-discovery-rules/beta_dlp_clear_text_credentials_outbound.yml @@ -14,43 +14,72 @@ severity: critical source: | type.outbound and ( - // ── ML extraction: body ──────────────────────────────────────────────── - - any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret") - and .confidence in ("medium", "high") - ) - - // ── ML extraction: subject ───────────────────────────────────────────── - - or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret") - and .confidence in ("medium", "high") - ) - - // ── Credential-bearing file types by extension and name ──────────────── - - or any(attachments, - .file_extension in~ ("env", "pem", "key", "p12", "pfx", "jks", "keystore", "ovpn") - or strings.icontains(.file_name, "credential") - or strings.icontains(.file_name, "secret") - or strings.icontains(.file_name, "password") - ) - - // ── ML extraction: attachments (raw text + OCR) ──────────────────────── - - or any(attachments, - any(file.explode(.), - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret") - and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type in ("private_key", "aws_access_key", "github_token", "http_authorization_header", "oauth_client_secret") - and .confidence in ("medium", "high") - ) - ) - ) + // ── ML extraction: body ──────────────────────────────────────────────── + any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, + .type in ( + "private_key", + "aws_access_key", + "github_token", + "http_authorization_header", + "oauth_client_secret" + ) + and .confidence in ("medium", "high") + ) + + // ── ML extraction: subject ───────────────────────────────────────────── + or any(beta.ml_extract_sensitive_information(subject.subject).elements, + .type in ( + "private_key", + "aws_access_key", + "github_token", + "http_authorization_header", + "oauth_client_secret" + ) + and .confidence in ("medium", "high") + ) + + // ── Credential-bearing file types by extension and name ──────────────── + or any(attachments, + .file_extension in~ ( + "env", + "pem", + "key", + "p12", + "pfx", + "jks", + "keystore", + "ovpn" + ) + or strings.icontains(.file_name, "credential") + or strings.icontains(.file_name, "secret") + or strings.icontains(.file_name, "password") + ) + + // ── ML extraction: attachments (raw text + OCR) ──────────────────────── + or any(attachments, + any(file.explode(.), + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type in ( + "private_key", + "aws_access_key", + "github_token", + "http_authorization_header", + "oauth_client_secret" + ) + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type in ( + "private_key", + "aws_access_key", + "github_token", + "http_authorization_header", + "oauth_client_secret" + ) + and .confidence in ("medium", "high") + ) + ) + ) ) tags: - "Credentials" diff --git a/dlp-discovery-rules/beta_dlp_cn_prc_id.yml b/dlp-discovery-rules/beta_dlp_cn_prc_id.yml index fef4c943349..3c26450b7bd 100644 --- a/dlp-discovery-rules/beta_dlp_cn_prc_id.yml +++ b/dlp-discovery-rules/beta_dlp_cn_prc_id.yml @@ -16,22 +16,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "cn_prc_id" and .confidence in ("medium", "high") + .type == "cn_prc_id" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "cn_prc_id" and .confidence in ("medium", "high") + .type == "cn_prc_id" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "cn_prc_id" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "cn_prc_id" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "cn_prc_id" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "cn_prc_id" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_crypto_wallet_address.yml b/dlp-discovery-rules/beta_dlp_crypto_wallet_address.yml index 1964ce4b891..dc138f813e4 100644 --- a/dlp-discovery-rules/beta_dlp_crypto_wallet_address.yml +++ b/dlp-discovery-rules/beta_dlp_crypto_wallet_address.yml @@ -6,24 +6,26 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "crypto_wallet_address" and .confidence in ("medium", "high") + .type == "crypto_wallet_address" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "crypto_wallet_address" and .confidence in ("medium", "high") + .type == "crypto_wallet_address" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "crypto_wallet_address" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "crypto_wallet_address" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "crypto_wallet_address" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "crypto_wallet_address" + and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "Financial data" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_de_passport.yml b/dlp-discovery-rules/beta_dlp_de_passport.yml index f80563509d5..11838821377 100644 --- a/dlp-discovery-rules/beta_dlp_de_passport.yml +++ b/dlp-discovery-rules/beta_dlp_de_passport.yml @@ -16,22 +16,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "de_passport_number" and .confidence in ("medium", "high") + .type == "de_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "de_passport_number" and .confidence in ("medium", "high") + .type == "de_passport_number" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "de_passport_number" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "de_passport_number" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "de_passport_number" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "de_passport_number" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_de_personalausweis.yml b/dlp-discovery-rules/beta_dlp_de_personalausweis.yml index 8b259ad058b..8de98ca1dae 100644 --- a/dlp-discovery-rules/beta_dlp_de_personalausweis.yml +++ b/dlp-discovery-rules/beta_dlp_de_personalausweis.yml @@ -16,22 +16,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "de_personalausweis" and .confidence in ("medium", "high") + .type == "de_personalausweis" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "de_personalausweis" and .confidence in ("medium", "high") + .type == "de_personalausweis" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "de_personalausweis" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "de_personalausweis" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "de_personalausweis" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "de_personalausweis" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_de_tax_id.yml b/dlp-discovery-rules/beta_dlp_de_tax_id.yml index fc49bc3794b..92a0b7302ed 100644 --- a/dlp-discovery-rules/beta_dlp_de_tax_id.yml +++ b/dlp-discovery-rules/beta_dlp_de_tax_id.yml @@ -16,22 +16,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "de_tax_id" and .confidence in ("medium", "high") + .type == "de_tax_id" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "de_tax_id" and .confidence in ("medium", "high") + .type == "de_tax_id" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "de_tax_id" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "de_tax_id" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "de_tax_id" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "de_tax_id" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_de_vat.yml b/dlp-discovery-rules/beta_dlp_de_vat.yml index 679056672c0..7ae825154b1 100644 --- a/dlp-discovery-rules/beta_dlp_de_vat.yml +++ b/dlp-discovery-rules/beta_dlp_de_vat.yml @@ -15,22 +15,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "de_vat" and .confidence in ("medium", "high") + .type == "de_vat" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "de_vat" and .confidence in ("medium", "high") + .type == "de_vat" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "de_vat" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "de_vat" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "de_vat" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "de_vat" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_es_bank_account.yml b/dlp-discovery-rules/beta_dlp_es_bank_account.yml index e6dfc966ca3..a6cb507ebf7 100644 --- a/dlp-discovery-rules/beta_dlp_es_bank_account.yml +++ b/dlp-discovery-rules/beta_dlp_es_bank_account.yml @@ -15,22 +15,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "es_bank_account" and .confidence in ("medium", "high") + .type == "es_bank_account" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "es_bank_account" and .confidence in ("medium", "high") + .type == "es_bank_account" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "es_bank_account" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "es_bank_account" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "es_bank_account" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "es_bank_account" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_es_id.yml b/dlp-discovery-rules/beta_dlp_es_id.yml index 22d42400b5c..3f1802359f4 100644 --- a/dlp-discovery-rules/beta_dlp_es_id.yml +++ b/dlp-discovery-rules/beta_dlp_es_id.yml @@ -16,22 +16,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "es_dni_nie_nif" and .confidence in ("medium", "high") + .type == "es_dni_nie_nif" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "es_dni_nie_nif" and .confidence in ("medium", "high") + .type == "es_dni_nie_nif" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "es_dni_nie_nif" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "es_dni_nie_nif" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "es_dni_nie_nif" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "es_dni_nie_nif" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_es_passport.yml b/dlp-discovery-rules/beta_dlp_es_passport.yml index 7eddddea898..ace89449d5a 100644 --- a/dlp-discovery-rules/beta_dlp_es_passport.yml +++ b/dlp-discovery-rules/beta_dlp_es_passport.yml @@ -16,22 +16,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "es_passport_number" and .confidence in ("medium", "high") + .type == "es_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "es_passport_number" and .confidence in ("medium", "high") + .type == "es_passport_number" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "es_passport_number" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "es_passport_number" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "es_passport_number" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "es_passport_number" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_fi_european_health_insurance.yml b/dlp-discovery-rules/beta_dlp_fi_european_health_insurance.yml index ad16704567f..3053721ebf9 100644 --- a/dlp-discovery-rules/beta_dlp_fi_european_health_insurance.yml +++ b/dlp-discovery-rules/beta_dlp_fi_european_health_insurance.yml @@ -15,22 +15,26 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "fi_european_health_insurance" and .confidence in ("medium", "high") + .type == "fi_european_health_insurance" + and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "fi_european_health_insurance" and .confidence in ("medium", "high") + .type == "fi_european_health_insurance" + and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "fi_european_health_insurance" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "fi_european_health_insurance" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "fi_european_health_insurance" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "fi_european_health_insurance" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_fr_bank_account.yml b/dlp-discovery-rules/beta_dlp_fr_bank_account.yml index d133dc9ddd3..e7d042a241d 100644 --- a/dlp-discovery-rules/beta_dlp_fr_bank_account.yml +++ b/dlp-discovery-rules/beta_dlp_fr_bank_account.yml @@ -15,22 +15,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "fr_bank_account" and .confidence in ("medium", "high") + .type == "fr_bank_account" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "fr_bank_account" and .confidence in ("medium", "high") + .type == "fr_bank_account" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "fr_bank_account" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "fr_bank_account" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "fr_bank_account" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "fr_bank_account" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_fr_cni.yml b/dlp-discovery-rules/beta_dlp_fr_cni.yml index 0a402124b4c..a49bb59b53b 100644 --- a/dlp-discovery-rules/beta_dlp_fr_cni.yml +++ b/dlp-discovery-rules/beta_dlp_fr_cni.yml @@ -16,22 +16,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "fr_cni" and .confidence in ("medium", "high") + .type == "fr_cni" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "fr_cni" and .confidence in ("medium", "high") + .type == "fr_cni" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "fr_cni" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "fr_cni" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "fr_cni" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "fr_cni" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_fr_driver_license.yml b/dlp-discovery-rules/beta_dlp_fr_driver_license.yml index 5c77c3e7d9a..f7be5f952cf 100644 --- a/dlp-discovery-rules/beta_dlp_fr_driver_license.yml +++ b/dlp-discovery-rules/beta_dlp_fr_driver_license.yml @@ -16,22 +16,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "fr_driver_license" and .confidence in ("medium", "high") + .type == "fr_driver_license" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "fr_driver_license" and .confidence in ("medium", "high") + .type == "fr_driver_license" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "fr_driver_license" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "fr_driver_license" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "fr_driver_license" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "fr_driver_license" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_fr_insee.yml b/dlp-discovery-rules/beta_dlp_fr_insee.yml index 8204f858a42..24013c6e48a 100644 --- a/dlp-discovery-rules/beta_dlp_fr_insee.yml +++ b/dlp-discovery-rules/beta_dlp_fr_insee.yml @@ -16,22 +16,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "fr_insee" and .confidence in ("medium", "high") + .type == "fr_insee" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "fr_insee" and .confidence in ("medium", "high") + .type == "fr_insee" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "fr_insee" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "fr_insee" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "fr_insee" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "fr_insee" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_fr_passport.yml b/dlp-discovery-rules/beta_dlp_fr_passport.yml index ed02becc4a9..7cbc6d63cf2 100644 --- a/dlp-discovery-rules/beta_dlp_fr_passport.yml +++ b/dlp-discovery-rules/beta_dlp_fr_passport.yml @@ -16,22 +16,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "fr_passport_number" and .confidence in ("medium", "high") + .type == "fr_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "fr_passport_number" and .confidence in ("medium", "high") + .type == "fr_passport_number" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "fr_passport_number" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "fr_passport_number" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "fr_passport_number" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "fr_passport_number" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_fr_vat.yml b/dlp-discovery-rules/beta_dlp_fr_vat.yml index 8a36a05a125..9d984871df9 100644 --- a/dlp-discovery-rules/beta_dlp_fr_vat.yml +++ b/dlp-discovery-rules/beta_dlp_fr_vat.yml @@ -15,22 +15,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "fr_vat" and .confidence in ("medium", "high") + .type == "fr_vat" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "fr_vat" and .confidence in ("medium", "high") + .type == "fr_vat" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "fr_vat" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "fr_vat" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "fr_vat" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "fr_vat" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_github_token.yml b/dlp-discovery-rules/beta_dlp_github_token.yml index d1e914d0350..d7fd48b6180 100644 --- a/dlp-discovery-rules/beta_dlp_github_token.yml +++ b/dlp-discovery-rules/beta_dlp_github_token.yml @@ -6,24 +6,25 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "github_token" and .confidence in ("medium", "high") + .type == "github_token" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "github_token" and .confidence in ("medium", "high") + .type == "github_token" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "github_token" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "github_token" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "github_token" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "github_token" + and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "Credentials" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_google_api_key.yml b/dlp-discovery-rules/beta_dlp_google_api_key.yml index 9773a6b9cd6..bee5998af6c 100644 --- a/dlp-discovery-rules/beta_dlp_google_api_key.yml +++ b/dlp-discovery-rules/beta_dlp_google_api_key.yml @@ -15,22 +15,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "google_api_key" and .confidence in ("medium", "high") + .type == "google_api_key" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "google_api_key" and .confidence in ("medium", "high") + .type == "google_api_key" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "google_api_key" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "google_api_key" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "google_api_key" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "google_api_key" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_http_authorization_header.yml b/dlp-discovery-rules/beta_dlp_http_authorization_header.yml index e749ee05ca1..d56b8f1c085 100644 --- a/dlp-discovery-rules/beta_dlp_http_authorization_header.yml +++ b/dlp-discovery-rules/beta_dlp_http_authorization_header.yml @@ -6,24 +6,27 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "http_authorization_header" and .confidence in ("medium", "high") + .type == "http_authorization_header" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "http_authorization_header" and .confidence in ("medium", "high") + .type == "http_authorization_header" + and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "http_authorization_header" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "http_authorization_header" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "http_authorization_header" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "http_authorization_header" + and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "Credentials" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_hu_taj.yml b/dlp-discovery-rules/beta_dlp_hu_taj.yml index 1e34fcb83f2..a0b279f73c8 100644 --- a/dlp-discovery-rules/beta_dlp_hu_taj.yml +++ b/dlp-discovery-rules/beta_dlp_hu_taj.yml @@ -15,22 +15,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "hu_taj" and .confidence in ("medium", "high") + .type == "hu_taj" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "hu_taj" and .confidence in ("medium", "high") + .type == "hu_taj" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "hu_taj" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "hu_taj" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "hu_taj" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "hu_taj" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_hu_vat.yml b/dlp-discovery-rules/beta_dlp_hu_vat.yml index 367cf2f745c..c456a9a81d6 100644 --- a/dlp-discovery-rules/beta_dlp_hu_vat.yml +++ b/dlp-discovery-rules/beta_dlp_hu_vat.yml @@ -15,22 +15,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "hu_vat" and .confidence in ("medium", "high") + .type == "hu_vat" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "hu_vat" and .confidence in ("medium", "high") + .type == "hu_vat" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "hu_vat" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "hu_vat" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "hu_vat" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "hu_vat" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_iban_code.yml b/dlp-discovery-rules/beta_dlp_iban_code.yml index f3fda1111d8..ce5656c0cfa 100644 --- a/dlp-discovery-rules/beta_dlp_iban_code.yml +++ b/dlp-discovery-rules/beta_dlp_iban_code.yml @@ -6,24 +6,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "iban_code" and .confidence in ("medium", "high") + .type == "iban_code" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "iban_code" and .confidence in ("medium", "high") + .type == "iban_code" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "iban_code" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "iban_code" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "iban_code" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "iban_code" and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "Financial data" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_jp_driver_license.yml b/dlp-discovery-rules/beta_dlp_jp_driver_license.yml index 664f2bc12b1..63d0349ef9f 100644 --- a/dlp-discovery-rules/beta_dlp_jp_driver_license.yml +++ b/dlp-discovery-rules/beta_dlp_jp_driver_license.yml @@ -16,22 +16,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "jp_driver_license" and .confidence in ("medium", "high") + .type == "jp_driver_license" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "jp_driver_license" and .confidence in ("medium", "high") + .type == "jp_driver_license" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "jp_driver_license" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "jp_driver_license" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "jp_driver_license" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "jp_driver_license" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_jp_my_number.yml b/dlp-discovery-rules/beta_dlp_jp_my_number.yml index c92e9dad898..597246f36da 100644 --- a/dlp-discovery-rules/beta_dlp_jp_my_number.yml +++ b/dlp-discovery-rules/beta_dlp_jp_my_number.yml @@ -16,22 +16,23 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "jp_my_number" and .confidence in ("medium", "high") + .type == "jp_my_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "jp_my_number" and .confidence in ("medium", "high") + .type == "jp_my_number" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "jp_my_number" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "jp_my_number" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "jp_my_number" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "jp_my_number" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_jp_passport.yml b/dlp-discovery-rules/beta_dlp_jp_passport.yml index 32c850c409c..6d8dbb163b1 100644 --- a/dlp-discovery-rules/beta_dlp_jp_passport.yml +++ b/dlp-discovery-rules/beta_dlp_jp_passport.yml @@ -16,22 +16,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "jp_passport_number" and .confidence in ("medium", "high") + .type == "jp_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "jp_passport_number" and .confidence in ("medium", "high") + .type == "jp_passport_number" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "jp_passport_number" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "jp_passport_number" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "jp_passport_number" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "jp_passport_number" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_jwt.yml b/dlp-discovery-rules/beta_dlp_jwt.yml index 62b412d624c..dcf0cf6748d 100644 --- a/dlp-discovery-rules/beta_dlp_jwt.yml +++ b/dlp-discovery-rules/beta_dlp_jwt.yml @@ -15,22 +15,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "jwt" and .confidence in ("medium", "high") + .type == "jwt" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "jwt" and .confidence in ("medium", "high") + .type == "jwt" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "jwt" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "jwt" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "jwt" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "jwt" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_kr_rrn.yml b/dlp-discovery-rules/beta_dlp_kr_rrn.yml index 1ab83e64a74..2cd3cccd56c 100644 --- a/dlp-discovery-rules/beta_dlp_kr_rrn.yml +++ b/dlp-discovery-rules/beta_dlp_kr_rrn.yml @@ -16,22 +16,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "kr_rrn" and .confidence in ("medium", "high") + .type == "kr_rrn" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "kr_rrn" and .confidence in ("medium", "high") + .type == "kr_rrn" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "kr_rrn" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "kr_rrn" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "kr_rrn" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "kr_rrn" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_luxembourg_nonnatural_id.yml b/dlp-discovery-rules/beta_dlp_luxembourg_nonnatural_id.yml index fe3f9c72a44..cf617c2970c 100644 --- a/dlp-discovery-rules/beta_dlp_luxembourg_nonnatural_id.yml +++ b/dlp-discovery-rules/beta_dlp_luxembourg_nonnatural_id.yml @@ -15,22 +15,25 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high") + .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high") + .type == "luxembourg_nonnatural_id" + and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "luxembourg_nonnatural_id" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "luxembourg_nonnatural_id" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "luxembourg_nonnatural_id" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_mac_address.yml b/dlp-discovery-rules/beta_dlp_mac_address.yml index 4208ef45e73..d1f69d8acc0 100644 --- a/dlp-discovery-rules/beta_dlp_mac_address.yml +++ b/dlp-discovery-rules/beta_dlp_mac_address.yml @@ -15,22 +15,23 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "mac_address" and .confidence in ("medium", "high") + .type == "mac_address" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "mac_address" and .confidence in ("medium", "high") + .type == "mac_address" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "mac_address" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "mac_address" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "mac_address" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "mac_address" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_nhs_number.yml b/dlp-discovery-rules/beta_dlp_nhs_number.yml index 8b513f36b1d..2b112c0ccd9 100644 --- a/dlp-discovery-rules/beta_dlp_nhs_number.yml +++ b/dlp-discovery-rules/beta_dlp_nhs_number.yml @@ -6,24 +6,25 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "nhs_number" and .confidence in ("medium", "high") + .type == "nhs_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "nhs_number" and .confidence in ("medium", "high") + .type == "nhs_number" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "nhs_number" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "nhs_number" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "nhs_number" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "nhs_number" + and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "PII" - "Health data" diff --git a/dlp-discovery-rules/beta_dlp_nl_bsn.yml b/dlp-discovery-rules/beta_dlp_nl_bsn.yml index 967b1d1f156..04b11f62807 100644 --- a/dlp-discovery-rules/beta_dlp_nl_bsn.yml +++ b/dlp-discovery-rules/beta_dlp_nl_bsn.yml @@ -16,22 +16,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "nl_bsn" and .confidence in ("medium", "high") + .type == "nl_bsn" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "nl_bsn" and .confidence in ("medium", "high") + .type == "nl_bsn" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "nl_bsn" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "nl_bsn" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "nl_bsn" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "nl_bsn" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_nl_vat.yml b/dlp-discovery-rules/beta_dlp_nl_vat.yml index 87ced19f230..a8488795c07 100644 --- a/dlp-discovery-rules/beta_dlp_nl_vat.yml +++ b/dlp-discovery-rules/beta_dlp_nl_vat.yml @@ -15,22 +15,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "nl_vat" and .confidence in ("medium", "high") + .type == "nl_vat" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "nl_vat" and .confidence in ("medium", "high") + .type == "nl_vat" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "nl_vat" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "nl_vat" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "nl_vat" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "nl_vat" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_nz_bank_account.yml b/dlp-discovery-rules/beta_dlp_nz_bank_account.yml index 864367fdb4d..4a62d225f45 100644 --- a/dlp-discovery-rules/beta_dlp_nz_bank_account.yml +++ b/dlp-discovery-rules/beta_dlp_nz_bank_account.yml @@ -15,22 +15,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "nz_bank_account" and .confidence in ("medium", "high") + .type == "nz_bank_account" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "nz_bank_account" and .confidence in ("medium", "high") + .type == "nz_bank_account" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "nz_bank_account" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "nz_bank_account" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "nz_bank_account" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "nz_bank_account" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_nz_moh.yml b/dlp-discovery-rules/beta_dlp_nz_moh.yml index 03f2df4bca7..f8ca389ed02 100644 --- a/dlp-discovery-rules/beta_dlp_nz_moh.yml +++ b/dlp-discovery-rules/beta_dlp_nz_moh.yml @@ -15,22 +15,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "nz_moh" and .confidence in ("medium", "high") + .type == "nz_moh" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "nz_moh" and .confidence in ("medium", "high") + .type == "nz_moh" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "nz_moh" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "nz_moh" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "nz_moh" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "nz_moh" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_oauth_client_secret.yml b/dlp-discovery-rules/beta_dlp_oauth_client_secret.yml index 17c6dccb5a7..6d7238da6dc 100644 --- a/dlp-discovery-rules/beta_dlp_oauth_client_secret.yml +++ b/dlp-discovery-rules/beta_dlp_oauth_client_secret.yml @@ -6,22 +6,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "oauth_client_secret" and .confidence in ("medium", "high") + .type == "oauth_client_secret" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "oauth_client_secret" and .confidence in ("medium", "high") + .type == "oauth_client_secret" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "oauth_client_secret" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "oauth_client_secret" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "oauth_client_secret" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "oauth_client_secret" + and .confidence in ("medium", "high") + ) + ) + ) ) ) tags: diff --git a/dlp-discovery-rules/beta_dlp_pci_us_credit_card_any.yml b/dlp-discovery-rules/beta_dlp_pci_us_credit_card_any.yml index 2a11fed9527..6074c2a88a7 100644 --- a/dlp-discovery-rules/beta_dlp_pci_us_credit_card_any.yml +++ b/dlp-discovery-rules/beta_dlp_pci_us_credit_card_any.yml @@ -6,24 +6,26 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "credit_card_number" and .confidence in ("medium", "high") + .type == "credit_card_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "credit_card_number" and .confidence in ("medium", "high") + .type == "credit_card_number" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "credit_card_number" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "credit_card_number" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "credit_card_number" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "credit_card_number" + and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "Financial data" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_pl_regon.yml b/dlp-discovery-rules/beta_dlp_pl_regon.yml index a54bbf71e0e..f97d564940f 100644 --- a/dlp-discovery-rules/beta_dlp_pl_regon.yml +++ b/dlp-discovery-rules/beta_dlp_pl_regon.yml @@ -15,22 +15,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "pl_regon" and .confidence in ("medium", "high") + .type == "pl_regon" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "pl_regon" and .confidence in ("medium", "high") + .type == "pl_regon" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "pl_regon" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "pl_regon" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "pl_regon" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "pl_regon" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_private_key.yml b/dlp-discovery-rules/beta_dlp_private_key.yml index 18db71ddd36..7461bc1ece9 100644 --- a/dlp-discovery-rules/beta_dlp_private_key.yml +++ b/dlp-discovery-rules/beta_dlp_private_key.yml @@ -6,22 +6,23 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "private_key" and .confidence in ("medium", "high") + .type == "private_key" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "private_key" and .confidence in ("medium", "high") + .type == "private_key" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "private_key" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "private_key" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "private_key" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "private_key" + and .confidence in ("medium", "high") + ) + ) + ) ) ) tags: diff --git a/dlp-discovery-rules/beta_dlp_se_personnummer.yml b/dlp-discovery-rules/beta_dlp_se_personnummer.yml index afcce466b4f..178cc4c2da1 100644 --- a/dlp-discovery-rules/beta_dlp_se_personnummer.yml +++ b/dlp-discovery-rules/beta_dlp_se_personnummer.yml @@ -16,22 +16,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "se_personnummer" and .confidence in ("medium", "high") + .type == "se_personnummer" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "se_personnummer" and .confidence in ("medium", "high") + .type == "se_personnummer" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "se_personnummer" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "se_personnummer" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "se_personnummer" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "se_personnummer" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_sg_nric.yml b/dlp-discovery-rules/beta_dlp_sg_nric.yml index 2a8d9424f2a..9853bfa0475 100644 --- a/dlp-discovery-rules/beta_dlp_sg_nric.yml +++ b/dlp-discovery-rules/beta_dlp_sg_nric.yml @@ -16,22 +16,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "sg_nric" and .confidence in ("medium", "high") + .type == "sg_nric" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "sg_nric" and .confidence in ("medium", "high") + .type == "sg_nric" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "sg_nric" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "sg_nric" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "sg_nric" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "sg_nric" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_sg_uen.yml b/dlp-discovery-rules/beta_dlp_sg_uen.yml index 2a6afb09aa5..d9a6714af23 100644 --- a/dlp-discovery-rules/beta_dlp_sg_uen.yml +++ b/dlp-discovery-rules/beta_dlp_sg_uen.yml @@ -15,22 +15,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "sg_uen" and .confidence in ("medium", "high") + .type == "sg_uen" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "sg_uen" and .confidence in ("medium", "high") + .type == "sg_uen" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "sg_uen" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "sg_uen" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "sg_uen" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "sg_uen" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_slack_access_token.yml b/dlp-discovery-rules/beta_dlp_slack_access_token.yml index 42febccf045..79170f6d7bd 100644 --- a/dlp-discovery-rules/beta_dlp_slack_access_token.yml +++ b/dlp-discovery-rules/beta_dlp_slack_access_token.yml @@ -15,22 +15,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "slack_access_token" and .confidence in ("medium", "high") + .type == "slack_access_token" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "slack_access_token" and .confidence in ("medium", "high") + .type == "slack_access_token" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "slack_access_token" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "slack_access_token" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "slack_access_token" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "slack_access_token" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_ssl_certificate.yml b/dlp-discovery-rules/beta_dlp_ssl_certificate.yml index ca52ef648e8..a0ed94a4d32 100644 --- a/dlp-discovery-rules/beta_dlp_ssl_certificate.yml +++ b/dlp-discovery-rules/beta_dlp_ssl_certificate.yml @@ -6,24 +6,26 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "ssl_certificate" and .confidence in ("medium", "high") + .type == "ssl_certificate" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "ssl_certificate" and .confidence in ("medium", "high") + .type == "ssl_certificate" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "ssl_certificate" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "ssl_certificate" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "ssl_certificate" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "ssl_certificate" + and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "Credentials" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_swift_bic.yml b/dlp-discovery-rules/beta_dlp_swift_bic.yml index 59d7f107ea6..6fca4a909e6 100644 --- a/dlp-discovery-rules/beta_dlp_swift_bic.yml +++ b/dlp-discovery-rules/beta_dlp_swift_bic.yml @@ -10,22 +10,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "swift_bic" and .confidence in ("medium", "high") + .type == "swift_bic" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "swift_bic" and .confidence in ("medium", "high") + .type == "swift_bic" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "swift_bic" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "swift_bic" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "swift_bic" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "swift_bic" and .confidence in ("medium", "high") + ) + ) + ) ) ) tags: diff --git a/dlp-discovery-rules/beta_dlp_uk_drivers_license.yml b/dlp-discovery-rules/beta_dlp_uk_drivers_license.yml index 4688865a782..affbc1a314d 100644 --- a/dlp-discovery-rules/beta_dlp_uk_drivers_license.yml +++ b/dlp-discovery-rules/beta_dlp_uk_drivers_license.yml @@ -6,24 +6,26 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "uk_drivers_license" and .confidence in ("medium", "high") + .type == "uk_drivers_license" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "uk_drivers_license" and .confidence in ("medium", "high") + .type == "uk_drivers_license" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "uk_drivers_license" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "uk_drivers_license" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "uk_drivers_license" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "uk_drivers_license" + and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "PII" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_uk_nino.yml b/dlp-discovery-rules/beta_dlp_uk_nino.yml index 50808adee7b..961b5386843 100644 --- a/dlp-discovery-rules/beta_dlp_uk_nino.yml +++ b/dlp-discovery-rules/beta_dlp_uk_nino.yml @@ -6,22 +6,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "uk_nino" and .confidence in ("medium", "high") + .type == "uk_nino" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "uk_nino" and .confidence in ("medium", "high") + .type == "uk_nino" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "uk_nino" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "uk_nino" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "uk_nino" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "uk_nino" and .confidence in ("medium", "high") + ) + ) + ) ) ) tags: diff --git a/dlp-discovery-rules/beta_dlp_uk_passport.yml b/dlp-discovery-rules/beta_dlp_uk_passport.yml index b17e5417527..737f2e964cb 100644 --- a/dlp-discovery-rules/beta_dlp_uk_passport.yml +++ b/dlp-discovery-rules/beta_dlp_uk_passport.yml @@ -6,24 +6,26 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "uk_passport_number" and .confidence in ("medium", "high") + .type == "uk_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "uk_passport_number" and .confidence in ("medium", "high") + .type == "uk_passport_number" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "uk_passport_number" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "uk_passport_number" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "uk_passport_number" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "uk_passport_number" + and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "PII" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_uk_utr.yml b/dlp-discovery-rules/beta_dlp_uk_utr.yml index d85b3cff5f1..7d58cb2af4c 100644 --- a/dlp-discovery-rules/beta_dlp_uk_utr.yml +++ b/dlp-discovery-rules/beta_dlp_uk_utr.yml @@ -6,24 +6,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "uk_utr" and .confidence in ("medium", "high") + .type == "uk_utr" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "uk_utr" and .confidence in ("medium", "high") + .type == "uk_utr" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "uk_utr" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "uk_utr" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "uk_utr" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "uk_utr" and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "PII" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_us_aba_routing_number.yml b/dlp-discovery-rules/beta_dlp_us_aba_routing_number.yml index 1dd76cab800..6c221db2410 100644 --- a/dlp-discovery-rules/beta_dlp_us_aba_routing_number.yml +++ b/dlp-discovery-rules/beta_dlp_us_aba_routing_number.yml @@ -6,22 +6,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "us_aba_routing_number" and .confidence in ("medium", "high") + .type == "us_aba_routing_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "us_aba_routing_number" and .confidence in ("medium", "high") + .type == "us_aba_routing_number" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "us_aba_routing_number" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "us_aba_routing_number" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "us_aba_routing_number" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "us_aba_routing_number" + and .confidence in ("medium", "high") + ) + ) + ) ) ) tags: diff --git a/dlp-discovery-rules/beta_dlp_us_bank_account.yml b/dlp-discovery-rules/beta_dlp_us_bank_account.yml index 27ad8604ab0..e04e9e928ba 100644 --- a/dlp-discovery-rules/beta_dlp_us_bank_account.yml +++ b/dlp-discovery-rules/beta_dlp_us_bank_account.yml @@ -6,24 +6,26 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "us_bank_number" and .confidence in ("medium", "high") + .type == "us_bank_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "us_bank_number" and .confidence in ("medium", "high") + .type == "us_bank_number" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "us_bank_number" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "us_bank_number" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "us_bank_number" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "us_bank_number" + and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "Financial data" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_us_dea_number.yml b/dlp-discovery-rules/beta_dlp_us_dea_number.yml index b85e8721e37..b9b962b24e8 100644 --- a/dlp-discovery-rules/beta_dlp_us_dea_number.yml +++ b/dlp-discovery-rules/beta_dlp_us_dea_number.yml @@ -15,22 +15,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "us_dea_number" and .confidence in ("medium", "high") + .type == "us_dea_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "us_dea_number" and .confidence in ("medium", "high") + .type == "us_dea_number" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "us_dea_number" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "us_dea_number" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "us_dea_number" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "us_dea_number" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_us_driver_license.yml b/dlp-discovery-rules/beta_dlp_us_driver_license.yml index ff088c1bce5..8429bab4ce5 100644 --- a/dlp-discovery-rules/beta_dlp_us_driver_license.yml +++ b/dlp-discovery-rules/beta_dlp_us_driver_license.yml @@ -6,24 +6,26 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "us_driver_license" and .confidence in ("medium", "high") + .type == "us_driver_license" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "us_driver_license" and .confidence in ("medium", "high") + .type == "us_driver_license" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "us_driver_license" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "us_driver_license" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "us_driver_license" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "us_driver_license" + and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "PII" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_us_icd10.yml b/dlp-discovery-rules/beta_dlp_us_icd10.yml index c6bf0e90d16..aa52a252c25 100644 --- a/dlp-discovery-rules/beta_dlp_us_icd10.yml +++ b/dlp-discovery-rules/beta_dlp_us_icd10.yml @@ -6,24 +6,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "us_icd10" and .confidence in ("medium", "high") + .type == "us_icd10" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "us_icd10" and .confidence in ("medium", "high") + .type == "us_icd10" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "us_icd10" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "us_icd10" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "us_icd10" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "us_icd10" and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "Health data" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_us_icd9.yml b/dlp-discovery-rules/beta_dlp_us_icd9.yml index dd0751c5d6c..7449720f107 100644 --- a/dlp-discovery-rules/beta_dlp_us_icd9.yml +++ b/dlp-discovery-rules/beta_dlp_us_icd9.yml @@ -6,24 +6,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "us_icd9" and .confidence in ("medium", "high") + .type == "us_icd9" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "us_icd9" and .confidence in ("medium", "high") + .type == "us_icd9" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "us_icd9" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "us_icd9" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "us_icd9" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "us_icd9" and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "Health data" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_us_itin.yml b/dlp-discovery-rules/beta_dlp_us_itin.yml index 96692a06d09..d29056a5d66 100644 --- a/dlp-discovery-rules/beta_dlp_us_itin.yml +++ b/dlp-discovery-rules/beta_dlp_us_itin.yml @@ -6,24 +6,24 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "us_itin" and .confidence in ("medium", "high") + .type == "us_itin" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "us_itin" and .confidence in ("medium", "high") + .type == "us_itin" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "us_itin" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "us_itin" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "us_itin" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "us_itin" and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "PII" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_us_medicare_beneficiary_id.yml b/dlp-discovery-rules/beta_dlp_us_medicare_beneficiary_id.yml index a80f469222f..4da9a069b2f 100644 --- a/dlp-discovery-rules/beta_dlp_us_medicare_beneficiary_id.yml +++ b/dlp-discovery-rules/beta_dlp_us_medicare_beneficiary_id.yml @@ -15,22 +15,26 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high") + .type == "us_medicare_beneficiary_id" + and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high") + .type == "us_medicare_beneficiary_id" + and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "us_medicare_beneficiary_id" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "us_medicare_beneficiary_id" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "us_medicare_beneficiary_id" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_us_npi.yml b/dlp-discovery-rules/beta_dlp_us_npi.yml index c39d7b5b3d3..5046c5f27de 100644 --- a/dlp-discovery-rules/beta_dlp_us_npi.yml +++ b/dlp-discovery-rules/beta_dlp_us_npi.yml @@ -15,22 +15,22 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "us_npi" and .confidence in ("medium", "high") + .type == "us_npi" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "us_npi" and .confidence in ("medium", "high") + .type == "us_npi" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "us_npi" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "us_npi" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "us_npi" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "us_npi" and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/beta_dlp_us_passport.yml b/dlp-discovery-rules/beta_dlp_us_passport.yml index 7c3485a58f9..1df7272a69d 100644 --- a/dlp-discovery-rules/beta_dlp_us_passport.yml +++ b/dlp-discovery-rules/beta_dlp_us_passport.yml @@ -6,24 +6,26 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "us_passport_number" and .confidence in ("medium", "high") + .type == "us_passport_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "us_passport_number" and .confidence in ("medium", "high") + .type == "us_passport_number" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "us_passport_number" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "us_passport_number" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "us_passport_number" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "us_passport_number" + and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "PII" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_us_ssn.yml b/dlp-discovery-rules/beta_dlp_us_ssn.yml index 803dc020b60..697b41f4fa0 100644 --- a/dlp-discovery-rules/beta_dlp_us_ssn.yml +++ b/dlp-discovery-rules/beta_dlp_us_ssn.yml @@ -6,24 +6,26 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "social_security_number" and .confidence in ("medium", "high") + .type == "social_security_number" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "social_security_number" and .confidence in ("medium", "high") + .type == "social_security_number" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "social_security_number" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "social_security_number" and .confidence in ("medium", "high") - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "social_security_number" + and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "social_security_number" + and .confidence in ("medium", "high") + ) + ) + ) ) ) - ) tags: - "PII" attack_types: diff --git a/dlp-discovery-rules/beta_dlp_vehicle_vin.yml b/dlp-discovery-rules/beta_dlp_vehicle_vin.yml index 6f0221a3c03..1774e2af473 100644 --- a/dlp-discovery-rules/beta_dlp_vehicle_vin.yml +++ b/dlp-discovery-rules/beta_dlp_vehicle_vin.yml @@ -15,22 +15,23 @@ source: | type.outbound and ( any(beta.ml_extract_sensitive_information(body.current_thread.text).elements, - .type == "vehicle_vin" and .confidence in ("medium", "high") + .type == "vehicle_vin" and .confidence in ("medium", "high") ) or any(beta.ml_extract_sensitive_information(subject.subject).elements, - .type == "vehicle_vin" and .confidence in ("medium", "high") + .type == "vehicle_vin" and .confidence in ("medium", "high") ) or any(attachments, - any(file.explode(.), - ( - any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, - .type == "vehicle_vin" and .confidence in ("medium", "high") - ) - or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, - .type == "vehicle_vin" and .confidence in ("medium", "high") - ) - ) - ) + any(file.explode(.), + ( + any(beta.ml_extract_sensitive_information(.scan.strings.raw).elements, + .type == "vehicle_vin" and .confidence in ("medium", "high") + ) + or any(beta.ml_extract_sensitive_information(.scan.ocr.raw).elements, + .type == "vehicle_vin" + and .confidence in ("medium", "high") + ) + ) + ) ) ) detection_methods: diff --git a/dlp-discovery-rules/dlp_slack_token.yml b/dlp-discovery-rules/dlp_slack_token.yml index 1f66263fc9a..7c16d9866d6 100644 --- a/dlp-discovery-rules/dlp_slack_token.yml +++ b/dlp-discovery-rules/dlp_slack_token.yml @@ -6,11 +6,14 @@ source: | type.outbound and any([body.current_thread.text, subject.subject], // Slack tokens: xoxb-, xoxp-, xoxa-, xoxr- - regex.contains(., '\bxox[bpar]-[0-9]{10,13}-[0-9]{10,13}-[A-Za-z0-9]{24,}\b') + regex.contains(., + '\bxox[bpar]-[0-9]{10,13}-[0-9]{10,13}-[A-Za-z0-9]{24,}\b' + ) // Slack webhook URLs - or regex.contains(., 'hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]{24}') + or regex.contains(., + 'hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]{24}' + ) ) - detection_methods: - "Content analysis" id: "99723c25-994d-59a5-ab4f-030415050c2e"