Safe Attachments detections

id: 16eda414-1550-4cdc-8512-0769901d3f05
name: Safe Attachments detections
description: |
  This query provides insights on the detections done by Safe Attachment detections
description-detailed: |
  This query provides insights on the detections done by Safe Attachment detections.
  Reference - https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-about
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where DetectionMethods != "" 
  | extend detection= tostring(parse_json(DetectionMethods).Phish) 
  | where detection has "File detonation reputation" or detection has "File detonation"
  | summarize total=count() by bin(Timestamp, 1d) 
  | order by Timestamp asc
version: 1.0.0