Sensitivity-labeled files seen on a specific device
This detection rule identifies what are the sensitivity-labeled files present on a specified device using the DeviceFileEvents table in Microsoft Defender for Endpoint. You can run this query to quickly determine whether a compromised device contains any files with sensitivity labels during investigation.
Microsoft Sentinel (KQL)
