User Email Submissions (FN) - Top Detection Overrides by Admins
This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was an admin definded policy override
Microsoft Sentinel (KQL)

This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was an admin definded policy override

Already have an account?