Spoof Detections Trend

Description

This query visualises total emails Business Email Compromise (BEC) Spoofing detections over time summarizing the data daily.

Query · kql

let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
EmailEvents 
| where DetectionMethods has 'Spoof' 
| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d 
| extend Details = "SpoofEmails"
| render timechart
Raw source Spoof Detections Trend · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 61c73b2b-4c62-4015-8677-f569d1e83b57
name: Spoof Detections Trend
description: |
  This query visualises total emails Business Email Compromise (BEC) Spoofing detections over time summarizing the data daily.
description-detailed: |
  This query visualises total emails Business Email Compromise (BEC) Spoofing detections over time summarizing the data daily.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  EmailEvents 
  | where DetectionMethods has 'Spoof' 
  | make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d 
  | extend Details = "SpoofEmails"
  | render timechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.