Impersonation Detections Trend

id: 761e4ddd-6b87-4c00-b033-55c3d0e4fe2e
name: Impersonation Detections Trend
description: |
  This query visualises total emails with Phish (BEC) - Impersonation detections over time.
description-detailed: |
  This query visualises total emails with Phish Business Email Compromise (BEC) Impersonation detections over time summarizing the data daily.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  EmailEvents 
  | where DetectionMethods has 'Impersonation' 
  | make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d 
  | extend Details = "ImpersonatedEmails"
  | render timechart
version: 1.0.0