Microsoft Sentinel informational experimental kql

Sensitive Data Discovered in the Last 24 Hours

'Identifies all classifications that have been detected on assets during a scan by Microsoft Purview within the last 24 hours.'

View Source

Detection Logic

PurviewDataSensitivityLogs
| where Classification != "[]"
| where TimeGenerated > ago(24h)

Field Validations

Loading…

Comments (0)

Loading comments...