Admin Submissions by Submission State (FP)

id: 598e2ee8-8d1d-4ded-998e-52cc43cf1160
name: Admin Submissions by Submission State (FP)
description: |
  This query visualises the total amount of admin false positive submissions by the state of the submission.
description-detailed: |
  This query visualises the total amount of admin false positive submissions by the state of the submission.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType contains "AdminSubmission"
  | extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)
  | where Record == 29 and SubmissionType == "3"
  | summarize count() by tostring(SubmissionState)
  | render piechart
version: 1.0.0