Teams Admin submission of Malware and Phish daily trend

id: 13db68a8-bce1-4929-b8db-2589ee552e75
name:  Teams Admin submission of Malware and Phish daily trend
description: |
  This query visualises the daily amount of admin false negative Teams message submissions by submission type of Phish or Malware 
description-detailed: |
  This query visualises the daily amount of admin false negative Teams message submissions by submission type of Phish or Malware 
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
 //Admin submission of false negative Teams message detections with Malware and Phish threat daily trend
 let TimeStart = startofday(ago(30d));
 let TimeEnd = startofday(now());
 let baseQuery=CloudAppEvents
 | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)
 | where ActionType == "AdminSubmissionSubmitted" and SubmissionContentType == "ChatMessage";
 let Admin_Malware_FN=baseQuery
 | make-series Count= countif(SubmissionType == "2") default = 0 on Timestamp from TimeStart to TimeEnd step 1d
 | extend Details = "Admin_Malware_FN";
 let Admin_Phish_FN=baseQuery
 | make-series Count= countif(SubmissionType == "1") default = 0 on Timestamp from TimeStart to TimeEnd step 1d
 | extend Details = "Admin_Phish_FN";
 union Admin_Malware_FN,Admin_Phish_FN
 | project Count, Details, Timestamp
 | render timechart
version: 1.0.0