Email Top 10 Targeted Users (Spam)

id: 22ae82b3-a362-4fc6-801d-d7fed7442d46
name: Email Top 10 Targeted Users (Spam)
description: |
  This query visualises top 10 users targeted with Spam.
description-detailed: |
  This query visualises total inbound emails with Spam detections summarizing the data by the top 10 recipient email address (RecipientEmailAddress).
  Taken from the the Microsoft Defender for Office 365 Detections and Insights - Microsoft Sentinel workbook.
  https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query visualises total inbound emails with Spam detections summarizing the data by the top 10 recipient email address (RecipientEmailAddress).
  EmailEvents 
  | where ThreatTypes has "Spam" and EmailDirection =="Inbound" 
  | where Timestamp > ago(30d) // last 30 days by default, replace 30d with the desired period
  | summarize count() by RecipientEmailAddress 
  | sort by count_ desc
  | take 10
  | render piechart // Uncomment this line to render as a graph
version: 1.0.0