User Email Submissions (FN) - Top Detection Overrides by Admins

Description

This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was an admin definded policy override

Query · kql

CloudAppEvents 
| where ActionType == "UserSubmission"
| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId
| extend User_SubmissionType=
iff(SubmissionType == "1" and ActionType == "UserSubmission" and SubmissionContentType=="Mail","User_Phish_FN",
iff(SubmissionType == "0" and ActionType == "UserSubmission" and SubmissionContentType=="Mail","User_Spam_FN","Other")),
NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))
| where SubmissionContentType == "Mail" and SubmissionType in ("1","0")
| join EmailEvents on NetworkMessageId, RecipientObjectId
| where ThreatTypes !=""and OrgLevelAction!=""
| summarize count() by OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType
| project OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType, UserSubmissions = count_
| top 10 by UserSubmissions desc
Raw source User Email Submissions (FN) - Top Detection Overrides by Admins · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: a52e4273-cf3c-4125-b03d-41b99f64197f
name: User Email Submissions (FN) - Top Detection Overrides by Admins
description: |
  This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was an admin definded policy override
description-detailed: |
  This query visualises emails submitted as false negatives by users where emails were already detected by MDO but there was an admin definded (tenant-level) policy override
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents 
  | where ActionType == "UserSubmission"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId
  | extend User_SubmissionType=
  iff(SubmissionType == "1" and ActionType == "UserSubmission" and SubmissionContentType=="Mail","User_Phish_FN",
  iff(SubmissionType == "0" and ActionType == "UserSubmission" and SubmissionContentType=="Mail","User_Spam_FN","Other")),
  NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))
  | where SubmissionContentType == "Mail" and SubmissionType in ("1","0")
  | join EmailEvents on NetworkMessageId, RecipientObjectId
  | where ThreatTypes !=""and OrgLevelAction!=""
  | summarize count() by OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType
  | project OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType, UserSubmissions = count_
  | top 10 by UserSubmissions desc
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.