Detecting Sensitivity-Labeled Files Sent to Public Email Domains
This query identifies files with specified sensitivity label that were sent as email attachments to external recipients at public email domains.
Microsoft Sentinel (KQL)

This query identifies files with specified sensitivity label that were sent as email attachments to external recipients at public email domains.

Already have an account?