Teams messages from a specific sender by ThreadType

id: 0bb4d681-5aa5-414e-b512-42a682ce5117
name: Teams messages from a specific sender by ThreadType
description: |
  This query helps hunt for Teams messages from a specific sender by ThreadType.
description-detailed: |
  This query helps hunt for Teams messages from a specific sender by ThreadType, using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query gets the count of messages from a sender across all types of conversations
  let Sender = "norpely@contoso.com";
  MessageEvents
  | where SenderEmailAddress == Sender
  | summarize Count = count() by ThreadType
version: 1.0.0