Microsoft Sentinel high experimental kql

Mimecast Secure Email Gateway - Impersonation Protect

Detects threats from impersonation mail under targeted threat protection

View Source

Detection Logic

MimecastSIEM_CL
| where mimecastEventId_s == "mail_ttp_impersonation"

Field Validations

Loading…

Comments (0)

Loading comments...