Update impersonation_vanta.yml (#935)

Co-authored-by: Josh Kamdjou <[email protected]>

detection-rules/impersonation_vanta.yml

@@ -9,7 +9,7 @@ source: |
   type.inbound
   and (
     regex.imatch(sender.display_name, '\bvanta\b')
-    or strings.ilike(sender.email.local_part, '*vanta*')
+    or regex.imatch(sender.email.local_part, '(\b)vanta|vanta(\b)')
     or strings.ilevenshtein(sender.email.domain.sld, 'vanta') <= 1
   )
   and not (
@@ -19,7 +19,7 @@ source: |
   )
   and sender.email.domain.root_domain in $free_email_providers
   and sender.email.email not in $sender_emails
-
+  
   // negate highly trusted sender domains unless they fail DMARC authentication
   and
   (
@@ -34,6 +34,7 @@ source: |
     or sender.email.domain.root_domain not in $high_trust_sender_root_domains
   )
 
+
 attack_types:
   - "Credential Phishing"
 tactics_and_techniques: