Spam detection technologies

id: 366ce22d-74c1-4acd-8050-f5c6061eb6d1
name: Spam detection technologies
description: |
  This query visualises total emails with Spam detections summarizing the data by various Spam detection technologies/controls.
description-detailed: |
  This query visualises total emails with Spam detections summarizing the data by various Spam detection technologies/controls in Microsoft Defender for Office 365. Visualize with chart type "Piechart".
  Taken from the the Microsoft Defender for Office 365 Detections and Insights - Microsoft Sentinel workbook.
  https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query visualises total emails with Spam detections summarizing the data by various Spam detection technologies/controls in Microsoft Defender for Office 365.
  EmailEvents 
  | where DetectionMethods has 'Spam'
  | where Timestamp > ago(30d) // last 30 days by default, replace 30d with the desired period
  | project Timestamp, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) | summarize count() by Spam=tostring(column_ifexists('Spam', ''))
  | sort by count_
  // | render piechart  // Uncomment this line to render as a graph
version: 1.0.0