This content release includes a corrective update to a match rule summary expression and a log mapping bug fix. Changes are enumerated below.
- Rules
- [Updated] MATCH-S00137 Office Application or Browser Launching Shell
- Fix typo in summary expression key
- Keys updated:
summary_expression,normalized_summary
- [Updated] MATCH-S00137 Office Application or Browser Launching Shell
- Log Mappers
- [Updated] Microsoft Office 365 Active Directory Authentication Events
- Office_365 Mapping Correction
- Keys updated:
user_userId
- [Updated] Microsoft Office 365 Active Directory Authentication Events