Microsoft Sentinel medium experimental kql

VMware Cloud Web Security - Data Loss Prevention Violation

This Analytics rule receives VMware CWS DLP alerts and combines them with their respective Web Log events. Each Data Loss Prevention event is an alert of policy violations and should be investigated.

View Source

Detection Logic

VMware_CWS_DLPLogs_CL
| join kind=innerunique VMware_CWS_Weblogs_CL on TimeGenerated

Field Validations

Loading…

Comments (0)

Loading comments...