excludes false positives from outlign.co

[hilt86]

Outlign sends messages that probably match on task assigned messages from Outlign.

Description

Associated samples

[github-actions]

Test Rules Sync - Action Required

This PR was not automatically synced to test-rules because the author is not a member of the sublime-security organization.

To enable syncing, an organization member can comment /update-test-rules on this PR.

Once triggered, the rules will be synced on the next scheduled run (every 10 minutes).

[hilt86]

/update-test-rules

[zoomequipd]

Hello @hilt86 Thanks for this submission!

There are currently two different locations for handle FPs within this rule.

1. by negating the .href_url.domain.root_domain of the link (which you've implemented)
2. by negating on the sender root domain

Why did you select option 1 instead of 2?
Do you happen to have a sample that you can share (I'm on the Sublime Community slack if needed)?

Thanks again!