Follow the File Hash: Hunting for Sensitive Files Leaving Your Organization with Defender Advanced…

This article explains how to use KQL queries to correlate endpoint telemetry (MDE DeviceFileEvents) and email telemetry (MDO EmailAttachmentInfo) via SHA256 hashes to detect when sensitivity‑labeled files are sent to external recipients. It provides example queries, notes on customizing sensitivity labels and organization domains, and mentions Microsoft Purview Insider Risk Management as an additional telemetry source for detecting risky email exfiltration.