Microsoft Sentinel high experimental kql

Mimecast Secure Email Gateway - Impersonation Protect

'Detects threats from impersonation mail under targeted threat protection.'

View Source

Detection Logic

MimecastCG
| where Type == "email_ttp_impersonation"
| extend  SenderEnvelope = ['Sender Envelope'] , SenderIp = ['Sender IP']

Field Validations

Loading…

Comments (0)

Loading comments...