Dynamic Suspicious Domain Detection

Kevin Nguyen@kevin

•updated Feb 3, 2026•7•0•78

This alert generates a log when a device onboarded is seen connecting to a known malicious domain within the ThreatIntelIndicators table. The TimeGenerated field should not be changed as the table refreshes every ~10 days.