Phish and Malware received by user vs total amount of email

id: 229ec9f6-05cc-483d-b3dc-35f47575a5aa
name: Phish and Malware received by user vs total amount of email
description: |
  How much phish and malware emails vs good emails received the user in the given timeframe.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
query: |
  let UserToAnalyze="john.doe@contoso.com";
  EmailEvents
  | where RecipientEmailAddress==UserToAnalyze
  | project RecipientEmailAddress, ThreatTypes
  | evaluate pivot(ThreatTypes)
  | sort by RecipientEmailAddress asc