Blog Post

Microsoft Sentinel Blog
3 MIN READ

Ingest Office 365 DLP Events into Azure Sentinel

Alp Babayigit's avatar
Alp Babayigit
Icon for Microsoft rankMicrosoft
Nov 25, 2019
Having different use cases for SIEM is very interesting, and it is incredible to work with customers and partners on them. In one of my engagements, a customer asked about the possibility of ingestin...
Updated Nov 03, 2021
Version 2.0
investigation
microsoft sentinel
GaryBushey's avatar
GaryBushey
Bronze Contributor
Dec 05, 2019

In the code example where you are searching for "DLPRuleMatch" why do you do use where Operation contains "DLP" before where Operation == "DLPRuleMatch"  ?   Does that make the query faster?