Malware detections by Workload Type

id: 094a9823-e053-4b36-8678-cd70f048db91
name: Malware detections by Workload Type
description: |
  This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the workload in which they are stored
description-detailed: |
  This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the workload in which they are stored
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == 'FileMalwareDetected'
  | extend Appwithteams = iff(Application =~ 'Microsoft SharePoint Online',strcat(Application,' / Teams Files'),Application)
  | extend Appwithteams = trim_start('Microsoft',Appwithteams) | summarize count() by Appwithteams
  | sort by count_ desc
  | render piechart
  // | render columnchart // Uncomment to change the graph type
version: 1.0.0