Microsoft Sentinel medium experimental kql

McAfee ePO - Spam Email detected

'Detects when email was marked as spam.'

View Source

Detection Logic

McAfeeEPOEvent
| where EventId == '4650'
| extend IPCustomEntity = DvcIpAddr, HostCustomEntity = DvcHostname

Field Validations

Loading…

Comments (0)

Loading comments...