User Email Submissions (FN-FP) by Grading verdict

id: 3b9e6da0-3504-463f-80d3-31fe3f0261ff
name: User Email Submissions (FN-FP) by Grading verdict
description: |
  This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading.
description-detailed: |
  This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents 
  | where ActionType contains "UserSubmissionTriage" 
  | extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState,  SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict 
  | summarize count() by tostring(TriageVerdict)
  | render piechart
version: 1.0.0