Get in touch
← Sentinel Explorer
↳ GitHub sourceAnalytics ruleHigh

Filewall - Blocked files

View on GitHub ↗Original file ↗

Description

Identifies files blocked by Filewall for Microsoft 365 (SharePoint/OneDrive/Teams).
Rule type
Scheduled
Version
1.0.0
Declared status
Available
Query frequency
5m
Query period
5m
Trigger
gt 0

Declared MITRE coverage

ExfiltrationT1048

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

FilewallM365

Data types

FilewallFile_CL

KQL query

Original query, unchanged.

FilewallM365FileEvent()
| where EventVendor == 'ODI-X' and EventProduct == 'Filewall for Microsoft 365'
| where EventType == 'FileBlocked'

Declared entities

AccountFile

Related content

Links established from declared identifiers and solution manifests.

Solutions1
Connectors1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
86e7f6fd-5c29-4a3a-bced-3eca3fb0c621
Additional source files 2Solutions/Filewall for Microsoft 365/Analytic Rules/BlockedFiles.yamlsource ↗Solutions/Filewall for Microsoft 365/Data/Solution_FilewallM365.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.