Exchange Servers and Associated Security Alerts
'This query will dynamically identify Exchange servers using common web paths used by the application in the csUriStem. The query will then collect MDE alerts from the SecurityAlert table using the identified Exchange Server hostnames.'
Microsoft Sentinel (KQL)
