Skip to content

Commit f71450c

Browse files
committed
Learn Editor: Update apivendorecosystem.md
1 parent 07f292b commit f71450c

File tree

1 file changed

+13
-13
lines changed

1 file changed

+13
-13
lines changed

defender-office-365/apivendorecosystem.md

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -108,11 +108,11 @@ Use this example query to see third-party catch in Advanced Hunting.
108108

109109

110110
```kusto
111-
EmailEvents
112-
| where Timestamp > ago(7d)
113-
//List emails caught by a Third-party solution
114-
| where DetectionMethods contains "Thirdparty"
115-
| project NetworkMessageId, RecipientEmailAddress, ThreatTypes, DetectionMethods, AdditionalFields, LatestDeliveryLocation
111+
EmailEvents
112+
| where Timestamp > ago(7d)
113+
//List emails caught by a Third-party solution
114+
| where DetectionMethods contains "Thirdparty"
115+
| project NetworkMessageId, RecipientEmailAddress, ThreatTypes, DetectionMethods, AdditionalFields, LatestDeliveryLocation
116116
```
117117

118118
## Reporting
@@ -147,21 +147,21 @@ You can use this integration with multiple ICES/CAPES vendors as long as they're
147147

148148
The "highest" verdict takes precedence. The precedence should be as follows (highest to lowest precedence):
149149

150-
Malware
150+
1. Malware
151151

152-
High Confidence Phish
152+
1. High Confidence Phish
153153

154-
Phish
154+
1. Phish
155155

156-
High Confidence Spam
156+
1. High Confidence Spam
157157

158-
Spam
158+
1. Spam
159159

160-
Deleted
160+
1. Deleted
161161

162-
Junk
162+
1. Junk
163163

164-
Clean or Not Spam
164+
1. Clean or Not Spam
165165

166166
**What if I utilize a different third-party application?**
167167

0 commit comments

Comments
 (0)