Query improvements - Exfiltration to Competitor

[Jay1508]

Hi,

I believe the query "Detect Exfiltration to Competitor Organization" could be improved. Instead of filtering on the string "competitor", cant we just put the domain of the competitors:

EmailEvents
| where RecipientEmailAddress contains "competitor.com" // domain of the competitor.