id: 0b014a34-413b-43ae-9d80-b617fad1fd5b
name: Email Top Domains sending Phish
description: |
This query visualises total inbound emails with Phish detections summarizing the data by the top email sender P2 domain (SenderFromDomain).
description-detailed: |
This query visualises total inbound emails with Phish detections summarizing the data by the top email sender P2 domain (SenderFromDomain).
The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the "//" to apply the exclusion.
Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- EmailEvents
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
EmailEvents
//| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
| where ThreatTypes has "Phish" and EmailDirection == "Inbound"
| summarize count() by SenderFromDomain
| sort by count_
| top 15 by count_
//| render columnchart // Uncomment to display as a column graph
//| render piechart // Uncomment to display as a piechart
version: 1.0.0