Microsoft Sentinel high experimental kql

Mimecast Secure Email Gateway - URL Protect

Detect threat when potentially malicious url found

View Source

Detection Logic

MimecastSIEM_CL
| where mimecastEventId_s=="mail_ttp_url" and reason_s != "clean"

Field Validations

Loading…

Comments (0)

Loading comments...