Malicious Teams messages by URL detection methods

id: 97c8d961-add7-4b58-80ef-75cc40d9d919
name:  Malicious Teams messages by URL detection methods
description: |
  This query helps reviewing malicious Teams message detections by URL detection methods 
description-detailed: |
  This query helps reviewing malicious Teams message detections by URL detection methods 
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
 //This query helps reviewing malicious Teams message detections by URL detection methods
 MessageEvents
 | where isnotempty(DetectionMethods)
 | extend MDO_detection = parse_json(DetectionMethods)
 | summarize TotalMessageCount = count(),
            Phish_detection = countif(isnotempty(MDO_detection.Phish)),
            Malware_detection = countif(isnotempty(MDO_detection.Malware)),
            URL_malicious_reputation = countif(MDO_detection.Phish == @'["URL malicious reputation"]' or MDO_detection.Malware == @'["URL malicious reputation"]'),
            URL_detonation_reputation = countif(MDO_detection.Phish == @'["URL detonation reputation"]' or MDO_detection.Malware == @'["URL detonation reputation"]')
            by bin(Timestamp, 1d)
 | project Timestamp, Phish_detection, Malware_detection,URL_malicious_reputation,URL_detonation_reputation
 | render timechart
version: 1.0.0