Admin Submissions by Detection Type

id: 4d525db4-ce23-49f7-844e-d06db21cdfa9
name: Admin Submissions by Detection Type
description: |
  This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type
description-detailed: |
  This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "AdminSubmissionSubmitted"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)
  | extend Admin_SubmissionType=
  iff(SubmissionType == "3" and ActionType == "AdminSubmissionSubmitted" and SubmissionContentType=="Mail" ,"Admin_Email_FP",
  "Other"),
  P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)
  | where SubmissionContentType == "Mail" and SubmissionType == "3"
  | summarize count() by PolicyOverride,DetectionVerdict,Admin_SubmissionType
  | project PolicyOverride, DetectionVerdict,Admin_SubmissionType, Emails = count_
  | top 10 by Emails desc
  // | render piechart // Uncomment this line to render as a graph
version: 1.0.0