Hunting for user signals-clusters

In this detection,we use Email reported by user as malware or phish MDO alert as a starting point to identify the scope of a campaign.