Top 10 Detection Overrides - Admin Email Submissions (FN)
This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was an admin policy override
Microsoft Sentinel (KQL)

This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was an admin policy override

Already have an account?