User Email Submissions (FP) - Top Intra-Org P2 Senders

id: 2e5e39ae-99f9-4ba0-b5c4-9e76919a0f53
name: User Email Submissions (FP) - Top Intra-Org P2 Senders
description: |
  This query visualises the top 10 intra-org senders of emails submitted as false positives by users.
description-detailed: |
  This query visualises the top 10 intra-org senders of emails submitted as false positives by users.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let Submissions = CloudAppEvents
      | where Timestamp > ago(30d)
      | where ActionType == "UserSubmission"
      | extend RawData = parse_json(RawEventData)
      | where tostring(RawData.SubmissionContentType) == "Mail" and tostring(RawData.SubmissionType) == "3"
      | extend NetworkMessageId = tostring(RawData.ObjectId), RecipientObjectId = AccountObjectId
      | distinct NetworkMessageId, RecipientObjectId;
  EmailEvents
  | where Timestamp > ago(30d)
  | join kind=inner Submissions on NetworkMessageId, RecipientObjectId
  // De-duplicate to the latest EmailEvents record per message and recipient before counting
  | summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientObjectId
  | where EmailDirection == "Intra-org"
  | summarize count() by SenderMailFromAddress
  | top 10 by count_
  | project ['Sender Address'] = SenderMailFromAddress, ['Emails'] = count_
version: 1.0.0