Top accounts performing Teams user submissions FN or FP

id: 9ffbd78f-c87c-4fd2-96ec-fd46e27bbd21
name: Top accounts performing Teams user submissions FN or FP
description: |
 This query visualises the top users performing false negative or false positive user submissions of Teams messages
description-detailed: |
  This query visualises the top users performing false negative or false positive user submissions of Teams messages
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "UserSubmission"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),SubmittedBy=tostring((parse_json(RawEventData)).UserId)
  | where SubmissionContentType == "ChatMessage"
  | summarize count() by SubmittedBy
  | project SubmittedBy, TeamsMessages = count_
  |top 10 by TeamsMessages desc
version: l.0.0