Total Emails with Admin Overrides (Block)

Description

This query visualises the amount of emails subject to an admin policy with action of block, summarizing the data daily

Query · kql

EmailEvents
| where OrgLevelPolicy != "" and OrgLevelAction == "Block"
| make-series TotalAdminOverrides = count() default = 0 on Timestamp step 1d
// | render columnchart // Uncomment this line to render as a graph
Raw source Total Emails with Admin Overrides (Block) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 89a0a2aa-69c8-4586-95f5-7d003901adec
name: Total Emails with Admin Overrides (Block)
description: |
  This query visualises the amount of emails subject to an admin policy with action of block, summarizing the data daily
description-detailed: |
  This query visualises the amount of emails subject to an admin policy with action of block, summarizing the data daily
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where OrgLevelPolicy != "" and OrgLevelAction == "Block"
  | make-series TotalAdminOverrides = count() default = 0 on Timestamp step 1d
  // | render columnchart // Uncomment this line to render as a graph
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.