Malware Detections by Detection technology

Description

This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls.

Query · kql

EmailEvents 
| where DetectionMethods has 'Malware' 
| project Timestamp, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) | summarize count() by Malware=tostring(column_ifexists('Malware', ''))
| sort by count_ desc
| render piechart
Raw source Malware Detections by Detection technology · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 642057a3-e5af-46ce-a5f4-8968a5537dba
name: Malware Detections by Detection technology
description: |
  This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls.
description-detailed: |
  This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls in Microsoft Defender for Office 365.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents 
  | where DetectionMethods has 'Malware' 
  | project Timestamp, DT=parse_json(DetectionMethods) | evaluate bag_unpack(DT) | summarize count() by Malware=tostring(column_ifexists('Malware', ''))
  | sort by count_ desc
  | render piechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.