Top 10 senders - Teams users submissions FN or FP

Description

This query visualises Teams messages submitted by user as false negatives or false positives, summarizing the data by top 10 indidvidual senders of those messages

Query · kql

CloudAppEvents
| where ActionType == "UserSubmission"
| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2Sender=tostring((parse_json(RawEventData)).P2Sender)
| where SubmissionContentType == "ChatMessage"
| summarize count() by P2Sender
| project P2Sender, TeamsMessages = count_
| top 10 by TeamsMessages desc
Raw source Top 10 senders - Teams users submissions FN or FP · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 2d8448f5-c0a2-46d7-a004-e062970ccb7b
name: Top 10 senders - Teams users submissions FN or FP
description: |
  This query visualises Teams messages submitted by user as false negatives or false positives, summarizing the data by top 10 indidvidual senders of those messages
description-detailed: |
  This query visualises Teams messages submitted by user as false negatives or false positives, summarizing the data by top 10 indidvidual senders of those messages
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "UserSubmission"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2Sender=tostring((parse_json(RawEventData)).P2Sender)
  | where SubmissionContentType == "ChatMessage"
  | summarize count() by P2Sender
  | project P2Sender, TeamsMessages = count_
  | top 10 by TeamsMessages desc
version: l.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.