Teams User submissions daily trend

Description

This query visualises the daily amount of user false negative and false postive Teams message submissions

Query · kql

let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
let baseQuery=CloudAppEvents
| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)
| where ActionType == "UserSubmission" and SubmissionContentType == "ChatMessage";
let User_TeamsSubmission_FN_FP=baseQuery
| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| extend Details = "User_TeamsSubmission_FN_FP";
union User_TeamsSubmission_FN_FP
| project Count, Details, Timestamp
| render timechart
Raw source Teams User submissions daily trend · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: ace8e98a-660b-4fa9-a877-60644eb83344
name: Teams User submissions daily trend
description: |
  This query visualises the daily amount of user false negative and false postive Teams message submissions
description-detailed: |
 This query visualises the daily amount of user false negative and false postive Teams message submissions
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  let baseQuery=CloudAppEvents
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)
  | where ActionType == "UserSubmission" and SubmissionContentType == "ChatMessage";
  let User_TeamsSubmission_FN_FP=baseQuery
  | make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | extend Details = "User_TeamsSubmission_FN_FP";
  union User_TeamsSubmission_FN_FP
  | project Count, Details, Timestamp
  | render timechart
version: l.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.