Spam detection by delivery location

id: 5b6fcbad-675f-4d10-bfc7-054e3453f712
name: Spam detection by delivery location
description: |
  This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location.
description-detailed: |
  This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location in Microsoft Defender for Office 365. Visualize with chart type "Timechart".
  Taken from the the Microsoft Defender for Office 365 Detections and Insights - Microsoft Sentinel workbook.
  https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where Timestamp > ago(30d) // last 30 days by default, replace 30d with the desired period
  | where DetectionMethods has "Spam" and EmailDirection == "Inbound"
  | make-series TotalSpamDetections=count(),Quarantine = countif(DeliveryLocation == "Quarantine"),Junkfolder=countif(DeliveryLocation == "Junk folder") ,Inbox=countif(DeliveryLocation == "Inbox/folder"),Failed=countif(DeliveryLocation == "Failed"),Dropped=countif(DeliveryLocation == "Dropped") default = 0 on Timestamp step 1d 
  // | render timechart // Uncomment this line to render as a graph
version: 1.0.0