Misleading Detection Rule Name

[monkeyonbranch]

The detection rule name for Google Workspace Object Copied To External Drive... is misleading. It makes it sound as if someone is copying something to an external drive, i.e., exfiltrating data.

The detection logic only looks for events when someone is copying something FROM an external drive TO a internal (from Organization's perspective) drive.

Please update the rule name to make this more clear. I suggest External Object Copied to Google Workspace and Permissions Granted. I feel this name reflects the detection logic much better than the current name. It gives a very summarized and truthful description of what event has occured.

[botelastic[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[w0rk3r]

@terrancedejesus