Post Delivery Events over time

Description

This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge.

Query · kql

let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
EmailPostDeliveryEvents
| where Timestamp >= TimeStart
| where ActionType has "ZAP"
| make-series ZappedEmails = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| render timechart
Raw source Post Delivery Events over time · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: c10b22a0-6021-46f9-bdaf-05bf2350a554
name: Post Delivery Events over time
description: |
  This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge.
description-detailed: |
  This query visualises the daily amount of emails that had a post delivery action from zero-hour auto purge in Defender for Office 365
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailPostDeliveryEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  EmailPostDeliveryEvents
  | where Timestamp >= TimeStart
  | where ActionType has "ZAP"
  | make-series ZappedEmails = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | render timechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.