Get in touch
← Sentinel Explorer
↳ GitHub sourceAnalytics ruleHigh

Filewall - Blocked emails

View on GitHub ↗Original file ↗

Description

Identifies emails blocked by Filewall for Microsoft 365 (Exchange).
Rule type
Scheduled
Version
1.0.0
Declared status
Available
Query frequency
5m
Query period
5m
Trigger
gt 0

Declared MITRE coverage

ExfiltrationT1048

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

FilewallM365

Data types

FilewallExchange_CL

KQL query

Original query, unchanged.

FilewallM365ExchangeEvent()
| where EventVendor == 'ODI-X' and EventProduct == 'Filewall for Microsoft 365'
| where EventType == 'ThreatInfo' and EventResult == 'Blocked'

Declared entities

AccountMailMessage

Related content

Links established from declared identifiers and solution manifests.

Solutions1
Connectors1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
9b784b65-2d16-4c9f-9f59-2a5d4c659f42
Additional source files 2Solutions/Filewall for Microsoft 365/Analytic Rules/BlockedEmails.yamlsource ↗Solutions/Filewall for Microsoft 365/Data/Solution_FilewallM365.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.