Total Submissions by Submission State

id: 47e8ea7f-a7eb-4fe3-a96b-efe01155d9d3
name: Total Submissions by Submission State
description: |
  Total Submissions by Submission State
description-detailed: |
  Total Submissions by Submission Statein Defender for Office 365
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | extend Record = (parse_json(RawEventData)).RecordType
  | extend SubmissionState = (parse_json(RawEventData)).SubmissionState
  | extend UserKey = (parse_json(RawEventData)).UserKey
  | where Record == 29
  | where ActionType == "UserSubmission" or ActionType == "AdminSubmission"
  | summarize count() by tostring(SubmissionState)//, bin(Timestamp, 1d) | sort by count_
  // | render piechart // Uncomment this line to render as a graph
version: 1.0.0