User reported submissions

Description

This query helps reviewing user reported email submissions

Query · kql

CloudAppEvents 
| where Timestamp > ago(30d) 
| extend Record= (parse_json(RawEventData)).RecordType 
| extend SubmissionState = (parse_json(RawEventData)).SubmissionState  
| where Record == 29 
| where ActionType == "UserSubmission"
Raw source User reported submissions · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 0bd33643-c517-48b1-8211-25a7fbd15a50
name: User reported submissions
description: |
  This query helps reviewing user reported email submissions
description-detailed: |
  This query helps reviewing user reported email submissions in Defender for Office 365
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents 
  | where Timestamp > ago(30d) 
  | extend Record= (parse_json(RawEventData)).RecordType 
  | extend SubmissionState = (parse_json(RawEventData)).SubmissionState  
  | where Record == 29 
  | where ActionType == "UserSubmission"
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.