Top 10 sender domains - Admin email submissions (FN)

id: 138681b2-442b-46cb-b086-fbe9e407aa2c
name: Top 10 sender domains - Admin email submissions (FN)
description: |
  This query visualises emails submitted by admins as false negatives, summarizing the data by top 10 sender domains of those emails
description-detailed: |
  This query visualises emails submitted by admins as false negatives, summarizing the data by top 10 sender domains of those emails
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "AdminSubmissionSubmitted"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)
  | where SubmissionContentType == "Mail" and SubmissionType in ("2","1","0")
  | summarize count() by P2SenderDomain
  | project P2SenderDomain, Emails = count_
  | top 10 by Emails desc
version: 1.0.0