Microsoft Sentinel high experimental kql

Filewall - Blocked files

Identifies files blocked by Filewall for Microsoft 365 (SharePoint/OneDrive/Teams).

View Source

Detection Logic

FilewallM365FileEvent()
| where EventVendor == 'ODI-X' and EventProduct == 'Filewall for Microsoft 365'
| where EventType == 'FileBlocked'

Field Validations

Loading…

Comments (0)

Loading comments...