Malware detections by Workload Locations

id: bb6afb85-8e80-4c98-b73b-c2c821528a1c
name: Malware detections by Workload Locations
description: |
  This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored
description-detailed: |
  This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == 'FileMalwareDetected'
  | project location=(split(RawEventData.SiteUrl, '/')[4])
  | summarize count() by tostring(location)
  | sort by count_ desc
  | render columnchart
version: 1.0.0