Open Phish Urls In Emails
Query
let OpenPhish = externaldata (Url: string) ["https://openphish.com/feed.txt"];
EmailUrlInfo
| where Url has_any (OpenPhish)
| join EmailEvents on NetworkMessageIdExplanation
This query looks for email events that contain URLs listed in the OpenPhish feed.
Details
Benjamin Zulliger
Released: June 7, 2024
Tables
EmailUrlInfoEmailEvents
Keywords
EmailUrlInfoUrlOpenPhishEmailEventsNetworkMessageId
Operators
has_anyjoin