OnePlus/OxygenOS BYOD Exposure Scoring with Baseline and Defender Enrichment
This rule identifies enterprise resource access from OnePlus or OxygenOS devices that lack proper management or compliance. It calculates an exposure score based on factors including device management status, compliance state, device trust type, and whether the device is newly observed. The rule flags high and medium priority exposure incidents, specifically targeting non-managed or non-compliant BYOD devices, which could represent an increased risk profile for corporate data access.
Microsoft Sentinel (KQL)
