Tracking Sensitivity-Labeled Files Sent as Email Attachments
This query identifies sensitivity-labeled files sent as email attachments to external recipients. The results provide details including the sender, recipient, file name, file path, and device where the file was observed.
Microsoft Sentinel (KQL)

