Quarantine releases by Detection Types

Description

This query visualises emails released from quarantine and summarizing the result by the original filter verdict

Query · kql

let totalQuery = EmailPostDeliveryEvents
| where Action == "Quarantine release"
| join kind=inner (EmailEvents | where DeliveryLocation == "Quarantine") on NetworkMessageId
| extend MDO_detection = parse_json(DetectionMethods1)
| extend FirstDetection = iif(isempty(MDO_detection), "Clean", tostring(bag_keys(MDO_detection)[0]))
| extend FirstSubcategory = iif(FirstDetection != "Clean" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, ": ", tostring(MDO_detection[FirstDetection][0])), "No Detection (clean)")
| where FirstSubcategory contains "Malware" or FirstSubcategory contains "Phish" or FirstSubcategory contains "Spam"
| count;
EmailPostDeliveryEvents
| where Action == "Quarantine release"
| join kind=inner (EmailEvents | where DeliveryLocation == "Quarantine") on NetworkMessageId
| extend MDO_detection = parse_json(DetectionMethods1)
| extend FirstDetection = iif(isempty(MDO_detection), "Clean", tostring(bag_keys(MDO_detection)[0]))
| extend FirstSubcategory = iif(FirstDetection != "Clean" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, ": ", tostring(MDO_detection[FirstDetection][0])), "No Detection (clean)")
| where FirstSubcategory contains "Malware" or FirstSubcategory contains "Phish" or FirstSubcategory contains "Spam"
| summarize count_messages = count() by FirstSubcategory
| project FirstSubcategory, count_messages
| order by count_messages desc
| render piechart
Raw source Quarantine releases by Detection Types · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 87754d3a-0077-4ff9-b46e-6336b8d02287
name: Quarantine releases by Detection Types
description: |
  This query visualises emails released from quarantine and summarizing the result by the original filter verdict
description-detailed: |
  This query visualises emails released from quarantine and summarizing the result by the original filter verdict
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - EmailPostDeliveryEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let totalQuery = EmailPostDeliveryEvents
  | where Action == "Quarantine release"
  | join kind=inner (EmailEvents | where DeliveryLocation == "Quarantine") on NetworkMessageId
  | extend MDO_detection = parse_json(DetectionMethods1)
  | extend FirstDetection = iif(isempty(MDO_detection), "Clean", tostring(bag_keys(MDO_detection)[0]))
  | extend FirstSubcategory = iif(FirstDetection != "Clean" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, ": ", tostring(MDO_detection[FirstDetection][0])), "No Detection (clean)")
  | where FirstSubcategory contains "Malware" or FirstSubcategory contains "Phish" or FirstSubcategory contains "Spam"
  | count;
  EmailPostDeliveryEvents
  | where Action == "Quarantine release"
  | join kind=inner (EmailEvents | where DeliveryLocation == "Quarantine") on NetworkMessageId
  | extend MDO_detection = parse_json(DetectionMethods1)
  | extend FirstDetection = iif(isempty(MDO_detection), "Clean", tostring(bag_keys(MDO_detection)[0]))
  | extend FirstSubcategory = iif(FirstDetection != "Clean" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, ": ", tostring(MDO_detection[FirstDetection][0])), "No Detection (clean)")
  | where FirstSubcategory contains "Malware" or FirstSubcategory contains "Phish" or FirstSubcategory contains "Spam"
  | summarize count_messages = count() by FirstSubcategory
  | project FirstSubcategory, count_messages
  | order by count_messages desc
  | render piechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.