Spam detection trend

id: 2b373bca-b491-4b2f-906e-6f42eeab01a1
name: Spam detection trend
description: |
  This query visualises total emails with Spam detections over time summarizing the data daily
description-detailed: |
  This query visualises total emails with Spam detections over time summarizing the data daily in Microsoft Defender for Office 365. Visualize with chart type "Line".
  Taken from the the Microsoft Defender for Office 365 Detections and Insights - Microsoft Sentinel workbook.
  https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query visualises total emails with Spam detections over time summarizing the data daily.
  EmailEvents
  | where ThreatTypes has "Spam"
  | make-series Count = count() default = 0 on Timestamp step 1d
  // | render timechart // Uncomment this line to render as a graph
version: 1.0.0