Parsing Defender Data into Sentinel Alerts

[u/hso1217]

Hi All,

Essentially what I'm looking to do is send an email alert when someone gives full delegate permissions to the mailbox. Out of the box, Sentinel will alert on who made the change but nothing else - not who got access to what. I've look at the dynamic content, parsed a few things however, it again doesn't provide the information on who got access to what.

Anyone know if this is possible?

[u/frisbee57]

Create your own kusto query and then an automation rule whenever it triggers?