Open
Description
- In
detection_abstract.py
we look for observable of typeusername
- In practice, the valid type (see
SES_OBSERVABLE_TYPE_MAPPING
) isUser Name
;Username
/username
is invalid and static validation does not allwo for these values - This is causing a handful of detections to create risk objects of type
other
instead of typeuser
- Additionally,
device
is not a valid observable type perSES_OBSERVABLE_TYPE_MAPPING
(used in validation)