Microsoft Sentinel high experimental kql

Mimecast Secure Email Gateway - Attachment Protect

'Detect threat for mail attachment under the targeted threat protection.'

View Source

Detection Logic

MimecastCG
| where Type == "email_ttp_ap"
| extend  SenderEnvelope = ['Sender Envelope']  , SenderIp = ['Sender IP']

Field Validations

Loading…

Comments (0)

Loading comments...