Total Emails with User Overrides (Allow)
This query visualises the amount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found
Microsoft Sentinel (KQL)

This query visualises the amount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found

Already have an account?