Bad email percentage of Inbound emails

Description

This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.

Query · kql

EmailEvents
| where EmailDirection == "Inbound"
| summarize TotalEmailCount = count(),
BadEmailCount = countif(isnotempty(ThreatTypes)) by bin(Timestamp, 1d)
| extend Bad_Traffic_Percentage_Inbound = todouble(round(BadEmailCount / todouble(TotalEmailCount) * 100, 2))
| project Timestamp,Bad_Traffic_Percentage_Inbound
| render timechart
Raw source Bad email percentage of Inbound emails · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 2a662ac9-81de-4073-9374-45e3ebd5ae90
name: Bad email percentage of Inbound emails
description: |
  This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.
description-detailed: |
  This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where EmailDirection == "Inbound"
  | summarize TotalEmailCount = count(),
  BadEmailCount = countif(isnotempty(ThreatTypes)) by bin(Timestamp, 1d)
  | extend Bad_Traffic_Percentage_Inbound = todouble(round(BadEmailCount / todouble(TotalEmailCount) * 100, 2))
  | project Timestamp,Bad_Traffic_Percentage_Inbound
  | render timechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.