User Email Submissions (FN) - Top Detection Overrides by Users
This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was a policy override.
Microsoft Sentinel (KQL)

This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was a policy override.

Already have an account?