Malicious mails by sender IPs

id: a8ccbf35-4c6d-4a8f-8c42-04fd9b000a27
name: Malicious mails by sender IPs
description: |
  This query helps reviewing sender IPs sending malicious email of type Malware or Phish
description-detailed: |
  This query helps reviewing sender IPs sending malicious email of type Malware or Phish using Defender for Office 365 data.
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents 
  | where Timestamp > ago(30d) 
  | where ThreatTypes has "Phish" or ThreatTypes has "Malware"
  | summarize count() by SenderIPv4 //SenderIPv6
  | sort by count_
version: 1.0.0