User Email Submission Trend (FN)

Description

This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users.

Query · kql

let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
let baseQuery = CloudAppEvents
| where ActionType contains "UserSubmission"
| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType);
let User_Phish_FN=baseQuery
| make-series Count= countif(SubmissionType == "1" and ActionType == "UserSubmission" and SubmissionContentType=="Mail" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d 
| extend Details = "User_Phish_FN";
let User_Spam_FN=baseQuery
| make-series Count= countif(SubmissionType == "0" and ActionType == "UserSubmission" and SubmissionContentType=="Mail" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d 
| extend Details = "User_Spam_FN";
let User_AttackSim_Submission=baseQuery
| make-series Count= countif(ActionType == "AttackSimUserSubmission" and SubmissionContentType=="Mail" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d 
| extend Details = "User_AttackSim_Submission";
union User_Phish_FN,User_Spam_FN,User_AttackSim_Submission
| project Count, Details, Timestamp
| render timechart
Raw source User Email Submission Trend (FN) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 395047c1-254e-43fb-ad6e-ae74c8e0a873
name: User Email Submission Trend (FN)
description: |
  This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users.
description-detailed: |
  This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  let baseQuery = CloudAppEvents
  | where ActionType contains "UserSubmission"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType);
  let User_Phish_FN=baseQuery
  | make-series Count= countif(SubmissionType == "1" and ActionType == "UserSubmission" and SubmissionContentType=="Mail" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d 
  | extend Details = "User_Phish_FN";
  let User_Spam_FN=baseQuery
  | make-series Count= countif(SubmissionType == "0" and ActionType == "UserSubmission" and SubmissionContentType=="Mail" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d 
  | extend Details = "User_Spam_FN";
  let User_AttackSim_Submission=baseQuery
  | make-series Count= countif(ActionType == "AttackSimUserSubmission" and SubmissionContentType=="Mail" ) default = 0 on Timestamp from TimeStart to TimeEnd step 1d 
  | extend Details = "User_AttackSim_Submission";
  union User_Phish_FN,User_Spam_FN,User_AttackSim_Submission
  | project Count, Details, Timestamp
  | render timechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.