Allow 'applicationName=login for GSuite.ExternalMailForwarding`

[ben-githubs]

Background

A customer raised an issue with the current detection - email forwarding change events can come from applications with name user_accoutns or login. They observed events where applicationName=login did not raise alerts. We confirmed this behaviour and updated the rule.

Changes

• restrict applicationName to login or user_accounts instead of just user_accounts

Testing

• used a recent email forwarding event from our own logs as a test case

[github-actions]

😱
looks like some things could be wrong with the packs

[github-actions]

😱
looks like some things could be wrong with the packs