↳ GitHub sourceAnalytics ruleHigh
Samsung Knox - Suspicious URL Accessed Events
Description
'When a Knox device user clicks on URLs or links detected as suspicious (potentially phishing or malicious) with a high degree of confidence.'
- Rule type
- NRT
- Version
- 1.0.2
- Declared status
- Available
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
Samsung_Knox_User_CL
| where Name == "SUSPICIOUS_URL_ACCESSED"
and ConfidenceScore > 0.9
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
629d1d3↗- Source identifier
18d4d4f3-6605-4fd2-968c-82c171409c1c
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC