Immersive Labs- Create a detection rule - Google SecOps

a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; }

Hello everyone,

I hope you can help me. I am currently taking the "Google SecOps Fundamentals: Demonstrate Your Skills" course, and I am stuck on Task 12, where I need to create a detection rule.

I have already created the rule, but the lab is not recognizing it or marking the task as completed.

The instructions say that I need to create a rule that detects communication with one of the specified domains. I have configured the following rule, but I'm not sure if it is correct.

I am not very experienced with Chronicle/Google SecOps, so I am having trouble understanding what I might be missing.

Does anyone know what could be wrong or what additional configuration is required for the task to be validated?

Any guidance would be greatly appreciated. Thank you!

This is the rule I created:

rule lumma_c2_iocs {
meta:
author = "Diana Quezadas"
description = "Detect DNS queries to known Lumma C2 IOC domain."
severity = "HIGH"

events:
$e.metadata.event_type = "NETWORK_DNS"
$ioc_url = $e.network.dns.questions.name

re.regex(
$ioc_url,
 `(?i)^forbidstow\.site$`
)
outcome:
$domain = array_distinct($ioc_url)
$risk_score = 85

condition:
$e
}