From eb07600b3dc8943dd535897ea3a481d3a5fbcb1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jose=20Sebasti=C3=A1n=20Can=C3=B3s?= Date: Wed, 30 Jul 2025 13:11:40 +0200 Subject: [PATCH] Update custom-detection-rules.md --- defender-xdr/custom-detection-rules.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defender-xdr/custom-detection-rules.md b/defender-xdr/custom-detection-rules.md index 67757b5670..fab7ae04c4 100644 --- a/defender-xdr/custom-detection-rules.md +++ b/defender-xdr/custom-detection-rules.md @@ -194,7 +194,7 @@ Near real-time detections are supported for the following tables: - `DeviceProcessEvents` - `DeviceRegistryEvents` - `EmailAttachmentInfo` -- `EmailEvents` (except `LatestDeliveryLocation` and `LatestDeliveryAction` columns) +- `EmailEvents` (except `LatestDeliveryLocation`, `LatestDeliveryAction` and `ExchangeTransportRule` columns) - `EmailPostDeliveryEvents` - `EmailUrlInfo` - `IdentityDirectoryEvents`