Inbound Phishing or Malware Email Detected
This rule detects inbound emails classified as phishing or malware by the email security system. It summarizes the total number of such messages, provides sample subjects, and counts how many were blocked, delivered to mailboxes, junked, or had other actions. The rule specifically focuses on emails that were delivered to a mailbox, indicating a potential bypass of initial security measures or a need for further investigation.
Microsoft Sentinel (KQL)
