All Detections

Root Domain and Subdomain Activity Across Defender XDR Telemetry

avatar
Syed Usfar Wasim@nCD24
updated Sep 4, 20262112

This KQL inventories activity associated with a specified root domain and its subdomains across DeviceNetworkEvents, EmailUrlInfo, CloudAppEvents.

Microsoft Sentinel (KQL)