Mailflow by directionality

Description

This query helps reviewing inbound / outbound / intra-org emails by domain per day

Query · kql

EmailEvents 
| where Timestamp > ago(30d)
| extend domain = substring(RecipientEmailAddress, indexof(RecipientEmailAddress, "@")+1) 
| summarize total=count() by EmailDirection, domain, bin(Timestamp, 1d) 
| order by Timestamp asc
Raw source Mailflow by directionality · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 6b478186-da3b-4d71-beaa-aa5b42908499
name: Mailflow by directionality
description: |
  This query helps reviewing inbound / outbound / intra-org emails by domain per day
description-detailed: |
  This query helps reviewing inbound / outbound / intra-org emails by domain per day
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents 
  | where Timestamp > ago(30d)
  | extend domain = substring(RecipientEmailAddress, indexof(RecipientEmailAddress, "@")+1) 
  | summarize total=count() by EmailDirection, domain, bin(Timestamp, 1d) 
  | order by Timestamp asc
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.