id: 5caf3813-c628-48e2-be65-71b95be7ff85
name: Quarantine Phish Reason
description: |
This query visualises the total amount of phish emails that are quarantined, summarized by the detection method
description-detailed: |
This query visualises the total amount of phish emails that are quarantined, summarized by the detection method
Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- EmailEvents
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
EmailEvents
| where EmailDirection == "Inbound" and DetectionMethods has 'Phish' and DeliveryLocation == "Quarantine"
| project DT=parse_json(DetectionMethods)| evaluate bag_unpack(DT)| summarize count() by Phish=tostring(column_ifexists('Phish', ''))
| render piechart
version: 1.0.0