Top 10 sender domains - Teams user submissions FN or FP

Description

This query visualises Teams messages submitted by users as false negatives or false positives, summarizing the data by top 10 sender domains of those messages

Query · kql

CloudAppEvents
| where ActionType == "UserSubmission"
| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)
| where SubmissionContentType == "ChatMessage"
| summarize count() by P2SenderDomain
| project P2SenderDomain, TeamsMessages = count_
| top 10 by TeamsMessages desc
Raw source Top 10 sender domains - Teams user submissions FN or FP · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: bebb6652-3c52-4358-a946-ecd63cddf082
name: Top 10 sender domains - Teams user submissions FN or FP
description: |
 This query visualises Teams messages submitted by users as false negatives or false positives, summarizing the data by top 10 sender domains of those messages
description-detailed: |
  This query visualises Teams messages submitted by users as false negatives or false positives, summarizing the data by top 10 sender domains of those messages
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "UserSubmission"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)
  | where SubmissionContentType == "ChatMessage"
  | summarize count() by P2SenderDomain
  | project P2SenderDomain, TeamsMessages = count_
  | top 10 by TeamsMessages desc
version: l.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.