mirror of
https://github.com/domainaware/parsedmarc.git
synced 2026-08-03 14:12:20 +00:00
Add SMTP TLS test and fix YARA-L boolean comparisons
Co-authored-by: seanthegeek <44679+seanthegeek@users.noreply.github.com>
This commit is contained in:
co-authored by
seanthegeek
parent
6ad7233983
commit
cf916509ea
@@ -207,7 +207,7 @@ rule dmarc_aggregate_failures {
|
||||
$e.metadata.product_name = "parsedmarc"
|
||||
$e.event_type = "DMARC_AGGREGATE"
|
||||
$e.security_result.detection_fields.key = "dmarc_pass"
|
||||
$e.security_result.detection_fields.value = "false"
|
||||
$e.security_result.detection_fields.value = false
|
||||
|
||||
condition:
|
||||
$e
|
||||
@@ -244,7 +244,7 @@ rule repeated_dmarc_failures {
|
||||
$e.metadata.product_name = "parsedmarc"
|
||||
$e.event_type = "DMARC_AGGREGATE"
|
||||
$e.security_result.detection_fields.key = "dmarc_pass"
|
||||
$e.security_result.detection_fields.value = "false"
|
||||
$e.security_result.detection_fields.value = false
|
||||
$e.principal.ip = $source_ip
|
||||
|
||||
match:
|
||||
|
||||
Reference in New Issue
Block a user