File Malware Detection Trend

id: 71cdf9cb-39b7-40fe-a81f-2c125efc7d07
name: File Malware Detection Trend
description: |
  This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.
description-detailed: |
  This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  CloudAppEvents
  | where Timestamp >= TimeStart
  | where ActionType == 'FileMalwareDetected'
  | make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | render timechart
version: 1.0.0