Hunt for TABL changes

Description

This query helps hunting for Tenant allow/block list (TABL) changes in Defender for Office 365

Query · kql

CloudAppEvents
| where ActionType contains "TenantAllowBlockListItems"
| order by Timestamp desc
Raw source Hunt for TABL changes · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: bc2d8214-afb6-4876-b210-25b69325b9b2
name: Hunt for TABL changes
description: |
  This query helps hunting for Tenant allow/block list (TABL) changes in Defender for Office 365
description-detailed: |
  This query helps hunting for Tenant allow/block list (TABL) changes in Defender for Office 365
  Reference - https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-about
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
  CloudAppEvents
  | where ActionType contains "TenantAllowBlockListItems"
  | order by Timestamp desc
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.