Microsoft Sentinel high experimental kql

VTI - High Severity Domain Collision Detection

This will alert when a collision is detected for EmailUrlInfo events with VTI high severity domain IoCs

Detection Logic

EmailUrlInfo
| join kind=inner (VisaThreatIntelligenceIOC_CL
| where IOCType == "domain" and SourceSeverity == "High")
on $left.UrlDomain == $right.Value

Field Validations

Loading…

Comments (0)

Loading comments...