id: 46837704-62cb-4e37-ae25-eecced47c0f4
name: Bulk Emails by Sender Bulk Complaint level
description: |
This query visualises total inbound emails which has any Bulk complaint level.
description-detailed: |
This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels to understand how many messages are detected with each Bulk Complaint level in Microsoft Defender for Office 365.
Taken from the the Microsoft Defender for Office 365 Detections and Insights - Microsoft Sentinel workbook.
https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- EmailEvents
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels to understand how many messages are detected with each Bulk Complaint level.
EmailEvents
| where EmailDirection == "Inbound" and BulkComplaintLevel !=""
| where Timestamp > ago(30d) // last 30 days by default, replace 30d with the desired period
| summarize count() by BulkComplaintLevel
| sort by BulkComplaintLevel desc
| project BulkComplaintLevel,Emails=count_
version: 1.0.0