User not covered under display name impersonation
This query helps to find threats using display name impersonation for users not already protected with User Impersonation
Microsoft Sentinel (KQL)

This query helps to find threats using display name impersonation for users not already protected with User Impersonation

Already have an account?