Status of submissions

id: 1c390fd7-2668-4445-9b7d-055f3851be5f
name: Status of submissions
description: |
  This query helps reviewing status of submissions
description-detailed: |
  This query helps reviewing status of submissions in Defender for Office 365.
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where Timestamp > ago(30d) 
  | extend Record= (parse_json(RawEventData)).RecordType 
  | extend SubmissionState = (parse_json(RawEventData)).SubmissionState  
  | extend UserKey = (parse_json(RawEventData)).UserKey 
  | where Record == 29 
  | where ActionType == "UserSubmission" or ActionType == "AdminSubmission" 
  | summarize count() by tostring(SubmissionState) 
  | sort by count_
version: 1.0.0