Hey community,
I am starting with this simple rule that checks sender's IP address and sender's domain against VT. While getting an IP address is straightforward, the domain requires an extraction from sender's email address. I am using a regex for this extraction, however getting this error as given in subject line.
Here's the rule:
events:
$e.metadata.event_type = "EMAIL_TRANSACTION"
$e.network.email.from != ""
$e.network.email.from = $sender_email
$domain = re.regex($sender_email, "@([a-zA-Z0-9.-]+\\.[a-zA-Z]{2,})")
$vt.graph.relations.entity.ip = $ip
$vt.graph.relations.entity.domain.name = $domain
match:
$ip, $domain over 1h
outcome:
$alerted_ip = count_distinct($ip)
$alerted_domain = count_distinct($domain)
condition:
$e and $vt
}
