diff --git a/detection-rules/body_business_email_compromise_new_sender.yml b/detection-rules/body_business_email_compromise_new_sender.yml index 2c611b22b9e..82094c2fdea 100644 --- a/detection-rules/body_business_email_compromise_new_sender.yml +++ b/detection-rules/body_business_email_compromise_new_sender.yml @@ -22,7 +22,10 @@ source: | ) ) and ( - profile.by_sender().prevalence in ("new", "outlier") + ( + profile.by_sender().prevalence in ("new", "outlier") + and not profile.by_sender().solicited + ) or ( profile.by_sender().any_messages_malicious_or_spam and not profile.by_sender().any_false_positives