KQL Search

This KQL (Kusto Query Language) query is designed to identify specific email events based on a list of domains from an external source. Here's a simplified breakdown of what the query does:

1. Load External Data: It retrieves a list of domains from an external file hosted on GitHub. This file contains threat intelligence data from Volexity.

2. Define Excluded Domains: It specifies a list of domains to exclude from the results. In this case, it excludes any URLs that contain "links.infos.clubmed.com".

3. Filter Email Events: It searches through email events from the past 30 days.

4. Join with URL Information: It combines email events with URL information based on a common identifier, NetworkMessageId.

5. Check for Specific Domains: It filters the results to include only those emails where the URL contains any of the domains from the external list and where the email was not blocked.

6. Exclude Certain Domains: It further filters out any emails where the URL contains any of the excluded domains.

In summary, this query identifies recent email events that involve URLs from a specific list of potentially malicious domains, ensuring that these emails were not blocked and do not include certain excluded domains.