Email Delivery Telemetry and Threat Exposure Analysis
This rule identifies accounts receiving the most email and highest threat exposure by analyzing inbound email events. It counts total emails, delivered emails, junked emails, blocked emails, and specifically highlights emails with detected threats (Phish, Malware, Spam) that were successfully delivered to the user's inbox. The output is sorted to prioritize accounts with the highest number of delivered threats.
Microsoft Sentinel (KQL)
