Spoof and impersonation detections by sender IP

id: b3180ac0-6d94-494a-8b8c-fcc84319ea6e
name: Spoof and impersonation detections by sender IP
description: |
  This query helps reviewing count of spoof and impersonation detections done per sender IP
description-detailed: |
  This query helps reviewing count of spoof and impersonation detections done per sender IP using Defender for Office 365 data.
  Reference - https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/email-protection-basics-in-microsoft-365-spoof-and-impersonation/ba-p/3562938#:~:text=It%20detects%20impersonation%20based%20on%20each%20user%E2%80%99s%20individual
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents 
  |where Timestamp > ago (30d) and (DetectionMethods contains 'spoof' or DetectionMethods contains "impersonation")  
  | project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 
  | summarize count() by SenderIPv4
version: 1.0.0