ocsf-schema
ocsf-schema copied to clipboard
Mapping for mailbox rule events
Email services provide the capability to configure email forwarding, inbox rules, and more.
Such configuration may include complex settings. For example:
If an incoming email includes a subject with word “invoice” and the sender is ‘*.amazon.com’ then move the email to the mailbox folder “amazon invoices”.
Example of such a rule on M365 platform:
We may use the Entity Management class, while the entity is the relevant mailbox. However, we need an attribute or object to identify the email service provider as well as the rule that was created or modified. One idea that we discussed in the mapping weekly meeting is creating a new Profile that represents mailbox settings.
cc: @zschmerber-atlassian @cmcginley-splunk