Email Top 15 Targeted Users (Spam) with Additional Details

id: 3e33ce02-b74e-49cc-899d-0a1eb3128ee3
name: Email Top 15 Targeted Users (Spam) with Additional Details
description: |
  This query visualises top 15 users targeted with Spam with summarized spam detections.
description-detailed: |
  This query visualises total inbound emails with Spam detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).
  Taken from the the Microsoft Defender for Office 365 Detections and Insights - Microsoft Sentinel workbook.
  https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query visualises total inbound emails with Spam detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).
  EmailEvents
  | where ThreatTypes has "Spam" and EmailDirection =="Inbound"
  | where Timestamp > ago(90d) // last 30 days by default, replace 30d with the desired period
  | summarize count() by RecipientEmailAddress
  | sort by count_ desc
  | take 15
  | project RecipientEmailAddress,Emails=count_
version: 1.0.0