From b9af8b456a60cfe1c4dd736833fe1492a905b182 Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Mon, 25 Nov 2024 19:14:04 -0500 Subject: [PATCH] Update link_suspicious_message_unscannable_cloudflare.yml --- .../link_suspicious_message_unscannable_cloudflare.yml | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/detection-rules/link_suspicious_message_unscannable_cloudflare.yml b/detection-rules/link_suspicious_message_unscannable_cloudflare.yml index ca1c5df6e66..10cc17f2e2f 100644 --- a/detection-rules/link_suspicious_message_unscannable_cloudflare.yml +++ b/detection-rules/link_suspicious_message_unscannable_cloudflare.yml @@ -261,13 +261,7 @@ source: | ) ) ) - and ( - not profile.by_sender().solicited - or ( - profile.by_sender().any_messages_malicious_or_spam - and not profile.by_sender().any_false_positives - ) - ) + // negate highly trusted sender domains unless they fail DMARC authentication and ( (