Teams Admin submission of No Threats daily trend

Description

This query visualises the daily amount of admin false positive Teams message submissions

Query · kql

//Admin submission of false positive Teams message detections daily trend
let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
let baseQuery=CloudAppEvents
| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)
| where ActionType == "AdminSubmissionSubmitted" and SubmissionContentType == "ChatMessage";
let Admin_Teams_FP=baseQuery
| make-series Count= countif(SubmissionType == "3") default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| extend Details = "Admin_Teams_FP";
union Admin_Teams_FP
| project Count, Details, Timestamp
| render timechart
Raw source Teams Admin submission of No Threats daily trend · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 1a942d90-1e14-4fe9-8ad2-8af56ed16279
name:  Teams Admin submission of No Threats daily trend
description: |
  This query visualises the daily amount of admin false positive Teams message submissions
description-detailed: |
  This query visualises the daily amount of admin false positive Teams message submissions
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
 //Admin submission of false positive Teams message detections daily trend
 let TimeStart = startofday(ago(30d));
 let TimeEnd = startofday(now());
 let baseQuery=CloudAppEvents
 | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)
 | where ActionType == "AdminSubmissionSubmitted" and SubmissionContentType == "ChatMessage";
 let Admin_Teams_FP=baseQuery
 | make-series Count= countif(SubmissionType == "3") default = 0 on Timestamp from TimeStart to TimeEnd step 1d
 | extend Details = "Admin_Teams_FP";
 union Admin_Teams_FP
 | project Count, Details, Timestamp
 | render timechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.