zedfox

We have previously had good results using the CloudAppEvents table in Advanced Hunting, filtering on the ActionType "FileUploadedToCloud". Historically this query produced hundreds of results per day in our environment.

Over the past month or two, the number of results has dropped significantly, despite no changes to the query or to the way we would expect users to interact with cloud storage services. We are receiving other cloud events from these devices, so I don't think there is a telemetry issue.

Is anyone aware of recent changes, or have any other ideas?

Cat shit! Catch it! Cache hit...

Pay the fare for the fair air Ayr flair flare fayre.

Looking for an It (Stephen King) themed map. It was a funnel style DM map with small rooms and 'deemers, with upper layers and clown imagery etc.

UT99, back in the golden era!

Really hard to google because "it" is so generic.

Cheers.

Could anyone help with the KQL syntax for a Content Search please.

I would like emails which mention "Joe" or "Joe Bloggs", excluding emails sent To OR From "[email protected]".

I've tried the following with no luck - please rescue me.

• "Joe" OR "Joe Bloggs" AND NOT "[email protected]"

• (keyword:"Joe" OR keyword:"Joe Bloggs") AND NOT (from:"[email protected]" OR to:"[email protected]")

I've also tried using the GUI to say 'recipient = none of - [email protected]"

Has anyone achieved log ingestion from Zscaler ZIA and/or ZPA?

A big requirement for me, and can't see any results online. Just wanted to ask before I dive in and test myself.

How far have you taken your DLP policies? Any no-brainer rules to start with?