New insight: high_trust_auth_fail.yml (#1117)

insights/sender/high_trust_auth_fail.yml

@@ -0,0 +1,24 @@
+name: "High trust sender domain failed authentication"
+type: "query"
+source: |
+  filter([sender.email.email],
+       sender.email.domain.root_domain in $high_trust_sender_root_domains
+       and (
+         (
+           any(distinct(headers.hops, .authentication_results.dmarc is not null),
+               strings.ilike(.authentication_results.dmarc, "*fail")
+           )
+         )
+         or (
+           any(distinct(headers.hops, .authentication_results.spf is not null),
+               strings.ilike(.authentication_results.spf, "*fail")
+           )
+         )
+         or (
+           any(distinct(headers.hops, .authentication_results.dkim is not null),
+               strings.ilike(.authentication_results.dkim, "*fail")
+           )
+         )
+       )
+  )
+severity: "high"