Adding negation for auto-survey emails (#849)

sublime-security · Oct 10, 2023 · 3192977 · 3192977
1 parent 37c2654
commit 3192977
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/detection-rules/impersonation_recipient_sld_in_sender_local_fts.yml b/detection-rules/impersonation_recipient_sld_in_sender_local_fts.yml
@@ -31,6 +31,7 @@ source: |
       and strings.contains(sender.display_name, "via")
   )
   and sender.email.domain.root_domain not in $org_domains
+  and sender.email.domain.root_domain not in  ("medallia.com", "icims.com", "workday.com")
   and (
     profile.by_sender().prevalence in ("new", "outlier")
     or (