I have been working with the new UDM Querry Function for Chronicle. It doesn't look like the NOCASE statement works.
UDM Querry Function for Chronicle
+12- Silver 2
It looks like that our system had an issue. Shortly after I posted this we needed to have a reboot. After the reboot not only does nocase work, but so does regex.
We added this to our phishing playbooks. We take the sender, regex the subject and return all users (this includes the BCC) that received the email. We use the output to search exchange and move all copies of the email to the users deleted folder
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.