Mail item accessed

Description

This query helps reviewing emails accessed by end users using cloud app events data

Query · kql

CloudAppEvents
| where Timestamp > ago(30d)
| extend Record= (parse_json(RawEventData)).RecordType
| where Record == 50
| take 10
Raw source Mail item accessed · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 81ede5df-2ec3-40a5-9dff-1fe6a841079d
name: Mail item accessed
description: |
  This query helps reviewing emails accessed by end users using cloud app events data
description-detailed: |
  This query helps reviewing emails accessed by end users in their mailboxes using cloud app events data.
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where Timestamp > ago(30d)
  | extend Record= (parse_json(RawEventData)).RecordType
  | where Record == 50
  | take 10
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.