Forum Discussion
sulaimanncs915
Nov 16, 2023Copper Contributor
KQL QR Code Phishing
let trustedDomains = dynamic(["microsoft.com"]); let imageFileTypes = dynamic(["png", "jpeg", "svg"]); EmailEvents | where EmailDirection == "Inbound" | where AttachmentCount > 0 | where not(Se...
sulaimanncs915
Nov 16, 2023Copper Contributor
Hi I only have
Timestamp
Timestamp
Clive_Watson
Nov 17, 2023Bronze Contributor
Sorry I assumed this was in Microsoft Sentinel, if you are in Defender XDR then yes, use TimeStamp instead