Inbound Teams messages by sender domains

Description

This query helps reviewing volume of inbound external Teams message by sender domains

Query · kql

//This query helps reviewing volume of inbound external Teams message by sender domains
 MessageEvents 
 | where IsExternalThread==1 and IsOwnedThread==1
 | mv-expand Recipients = RecipientDetails
 | extend RecipientEmailAddress = Recipients.RecipientSmtpAddress, RecipientDisplayName = Recipients.RecipientDisplayName, RecipientObjectId = Recipients.RecipientObjectId, RecipientType = Recipients.RecipientType
 | extend Domain = substring(RecipientEmailAddress, indexof(RecipientEmailAddress, "@")+1)
 | summarize total=count() by Domain, bin(Timestamp, 1d) 
 | order by Timestamp asc
Raw source Inbound Teams messages by sender domains · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 15688e35-9957-427f-a8fb-95b7883120b3
name:  Inbound Teams messages by sender domains
description: |
  This query helps reviewing volume of inbound external Teams message by sender domains 
description-detailed: |
  This query helps reviewing volume of inbound external Teams message by sender domains 
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
 //This query helps reviewing volume of inbound external Teams message by sender domains
  MessageEvents 
  | where IsExternalThread==1 and IsOwnedThread==1
  | mv-expand Recipients = RecipientDetails
  | extend RecipientEmailAddress = Recipients.RecipientSmtpAddress, RecipientDisplayName = Recipients.RecipientDisplayName, RecipientObjectId = Recipients.RecipientObjectId, RecipientType = Recipients.RecipientType
  | extend Domain = substring(RecipientEmailAddress, indexof(RecipientEmailAddress, "@")+1)
  | summarize total=count() by Domain, bin(Timestamp, 1d) 
  | order by Timestamp asc
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.