Direct Send Email Accepted From Non-Approved Source IP
Audits Direct Send traffic against an approved-IP watchlist, flagging unauthenticated inbound mail spoofing an internal domain from an unrecognized source IP. Fixed: RecipientDomain/SenderFromDomain were referenced but never defined (would have errored at runtime); replaced with derived SenderDomain/RecipientDomain consistent with the sibling rules. Removed a noisy display-name-contains-domain OR-branch. Replaced an always-true-in-practice auth check (required every one of SPF/DKIM/DMARC to show literal "Pass", which fails for many legitimate senders that pass via alignment on only one protocol) with the same CompAuth/all-three-fail logic used elsewhere in this set.
Microsoft Sentinel (KQL)
