Elastic medium stable kql

Deprecated - M365 Security Compliance User Restricted from Sending Email

Identifies when a user has been restricted from sending email due to exceeding sending limits of the service policies per the Security Compliance Center.

View Source

Detection Logic

data_stream.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.category:web and event.action:"User restricted from sending email" and event.outcome:success

False Positives

⚠ A user sending emails using personal distribution folders may trigger the event.

Field Validations

Loading…

Comments (0)

Loading comments...