Malicious Emails Delivered With No AIR Triage
This query will generate an alert for any emails that Defender AIR identifies as malicious but has taken no AIR actions.
Microsoft Sentinel (KQL)
This query will generate an alert for any emails that Defender AIR identifies as malicious but has taken no AIR actions.
Already have an account?