This repository was archived by the owner on Nov 16, 2023. It is now read-only.
This repository was archived by the owner on Nov 16, 2023. It is now read-only.
Query improvements - Exfiltration to Competitor #298
Description
Hi,
I believe the query "Detect Exfiltration to Competitor Organization" could be improved. Instead of filtering on the string "competitor", cant we just put the domain of the competitors:
EmailEvents
| where RecipientEmailAddress contains "competitor.com" // domain of the competitor.