Managed Sentinel – Alert 183
| Alert ID | MS-A183 |
| Alert Name | Internal Hosts Using POP3 or IMAP Email Clients - SonicWall |
| Description | This alert identifies internal hosts accessing unsanctioned SMTP servers. Internal hosts should only use the SMTP relay servers configured for internal use. |
| Severity Level | Low |
| Threat Indicator | |
| MITRE ATT&CK Tactics | DefensiveEvasion Execution Exfiltration |
| Log sources | CommonSecurityLog |
| False Positives | |
| Recommendations |