Email Files Written Outside Of The Outlook Directory
The search looks at the change-analysis data model and detects email files created outside the normal Outlook directory.
This content is not mapped to any local saved search. Add mapping
Email Files Written Outside Of The Outlook Directory Help
To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes.
Open in Search