Total Emails with Admin Overrides (Allow)

Description

This query visualises the total amount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override

Query · kql

let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
EmailEvents 
| where OrgLevelPolicy != "" and OrgLevelAction == "Allow" // and OrgLevelPolicy != "SecOps Mailbox" // Remove to filter SecOps mailbox
| make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d by OrgLevelPolicy
| render timechart
Raw source Total Emails with Admin Overrides (Allow) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 85000725-df05-479e-8cfd-78310b659714
name: Total Emails with Admin Overrides (Allow)
description: |
  This query visualises the total amount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override
description-detailed: |
  This query visualises the total amount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  EmailEvents 
  | where OrgLevelPolicy != "" and OrgLevelAction == "Allow" // and OrgLevelPolicy != "SecOps Mailbox" // Remove to filter SecOps mailbox
  | make-series Count= count() on Timestamp from TimeStart to TimeEnd step 1d by OrgLevelPolicy
  | render timechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.