[IA] - Rating Email Type based on ISP
This KQL is focus on gather statistics related to hackers activities over our tenants, such as the number of emails sent tagged as threats. Below, I’ve provided KQL queries to help identify the risky ASNs mentioned at the beggining. You can adjust the filtering criteria by modifying the line: “| where SuspiciousPercentage > 95 and Total_different_IPs > 10” based on your specific requirements.
Microsoft Sentinel (KQL)
