Top accounts performing Teams admin submissions FN or FP

id: 0a29c9f0-e8d4-4339-a196-52bb3a090a79
name: Top accounts performing Teams admin submissions FN or FP
description: |
  This query visualises the top admins performing false negative or false positive admin submissions of Teams messages
description-detailed: |
  This query visualises the top admins performing false negative or false positive admin submissions of Teams messages
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "AdminSubmissionSubmitted"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),SubmittedBy=tostring((parse_json(RawEventData)).UserId)
  | where SubmissionContentType == "ChatMessage" and SubmissionType in ("1","2","3")
  | summarize count() by SubmittedBy
  | project SubmittedBy, TeamsMessages = count_
  |top 10 by TeamsMessages desc
version: l.0.0