Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Integrate Purview with Cloud App Events

Azure Sentinel@AzureSentinel

•updated Jun 17, 2025•1•0•41

"This query searches for any files in Cloud App Events that have trigger a security alert."

Microsoft Sentinel (KQL)

Tags

T1074 - Data Staged TA0009 - Collection TA0010 - Exfiltration T1059.009 - Cloud API T1070.004 - File Deletion T1204.002 - Malicious File T1567.004 - Exfiltration Over Webhook TA0002 - Execution TA0005 - Defense Evasion T1522 - Cloud Instance Metadata API S0099 - Arp DS0022 - File TA0006 - Credential Access Data Exfiltration File Access File Download File Upload Cloud Api Call Data Staging Office 365 Microsoft Servicebus Client M365 Unified Audit Logkqltactic:Collectiontechnique:T1074

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?