monkeyonbranch

Misleading Detection Rule Name

2

The detection rule name for [Google Workspace Object Copied To External Drive...](https://github.com/elastic/detection-rules/blob/main/rules/integrations/google_workspace/initial_access_object_copied_to_external_drive_with_app_consent.toml) is misleading. It makes it sound as if someone is copying something to an external drive, i.e., exfiltrating...