Update Office365 threat intel alert query to exclude blocked delivery actions
taylorwalton committed
Oct 22, 2025 at 08:56 UTC
e60281915c339fc50600fdf7d75d897ad2faf8cd
1 file changed
+1
-1
backend/app/integrations/monitoring_alert/services/provision.py
+1
-1
@@ -595,7 +595,7 @@ async def provision_office365_threat_intel_alert(
595
priority=2,
596
config=GraylogAlertProvisionConfig(
597
type="aggregation-v1",
598
- query="syslog_level:ALERT AND data_office365_UserId:ThreatIntel",
598
+ query="syslog_level:ALERT AND data_office365_UserId:ThreatIntel AND NOT data_office365_DeliveryAction:Blocked",
599
query_parameters=[],
600
streams=[],
601
group_by=[],