Admin Submissions by Submission Type (FP)

Description

This query visualises the total amount of admin false positive submission by submission type.

Query · kql

CloudAppEvents
| where ActionType contains "Submission"
| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)
| extend Admin_SubmissionType=
iff(SubmissionType == "3" and ActionType == "AdminSubmissionSubmitted" and SubmissionContentType=="Mail","Admin_Email_FP",
iff(SubmissionType == "3" and ActionType == "AdminSubmissionSubmitted" and SubmissionContentType=="URL","Admin_URL_FP",
iff(SubmissionType == "3" and ActionType == "AdminSubmissionSubmitted" and SubmissionContentType=="Attachment","Admin_Attach_FP",
"Other")))
| where Admin_SubmissionType!="Other"
| summarize count() by Admin_SubmissionType
| render piechart
Raw source Admin Submissions by Submission Type (FP) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 6f45e3cc-e810-43ce-a8df-289aaa2e0ca2
name: Admin Submissions by Submission Type (FP)
description: |
  This query visualises the total amount of admin false positive submission by submission type.
description-detailed: |
  This query visualises the total amount of admin false positive submission by submission type in Defender for Office 365
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType contains "Submission"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)
  | extend Admin_SubmissionType=
  iff(SubmissionType == "3" and ActionType == "AdminSubmissionSubmitted" and SubmissionContentType=="Mail","Admin_Email_FP",
  iff(SubmissionType == "3" and ActionType == "AdminSubmissionSubmitted" and SubmissionContentType=="URL","Admin_URL_FP",
  iff(SubmissionType == "3" and ActionType == "AdminSubmissionSubmitted" and SubmissionContentType=="Attachment","Admin_Attach_FP",
  "Other")))
  | where Admin_SubmissionType!="Other"
  | summarize count() by Admin_SubmissionType
  | render piechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.