Top 10 sender domains - Admin email submissions (FP)

id: c438f85f-4527-4358-a3b6-fe6a6ff7a202
name: Top 10 sender domains - Admin email submissions (FP)
description: |
  This query visualises emails submitted by admins as false positives, summarizing the data by top 10 sender domains of those emails
description-detailed: |
  This query visualises emails submitted by admins as false positives, summarizing the data by top 10 sender domains of those emails
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "AdminSubmissionSubmitted"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)
  | where SubmissionContentType == "Mail" and SubmissionType =="3"
  | summarize count() by P2SenderDomain
  | project P2SenderDomain, Emails = count_
  | top 10 by Emails desc
version: 1.0.0