Microsoft 365
Sentinel Rules
- RULE-1020 - Detect email forwarding rules
- RULE-1022 - Suspicious keyword in mailbox rule
- RULE-1023 - Mailbox auto-forwards
- RULE-1024 - Transport rule forwards email externally
- RULE-1026 - Transport rule with suspicious keywords
- RULE-1027 - Large number of external shares