Microsoft Sentinel informational experimental kql

Mimecast Secure Email Gateway - Virus

'Detect threat for virus from mail receipt virus event.'

View Source

Detection Logic

MimecastCG
| where Type == "email_receipt" and isnotempty(['Virus Found'])
| extend  SenderEnvelope = ['Sender Envelope']

Field Validations

Loading…

Comments (0)

Loading comments...