Total Emails with User Overrides (Block)

Description

This query visualises the amount of emails subject to a user type policy with action of block, summarizing the data daily

Query · kql

EmailEvents
| where UserLevelPolicy != "" and UserLevelAction == "Block"
| make-series TotalUserOverrides = count() default = 0 on Timestamp step 1d
// | render columnchart // Uncomment this line to render as a graph
Raw source Total Emails with User Overrides (Block) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 295ac28c-919c-48b9-8a38-a0f792f2b92b
name: Total Emails with User Overrides (Block)
description: |
  This query visualises the amount of emails subject to a user type policy with action of block, summarizing the data daily
description-detailed: |
  This query visualises the amount of emails subject to a user type policy with action of block, summarizing the data daily
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where UserLevelPolicy != "" and UserLevelAction == "Block"
  | make-series TotalUserOverrides = count() default = 0 on Timestamp step 1d
  // | render columnchart // Uncomment this line to render as a graph
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.