Top policies performing admin overrides

Description

This query helps in reviewing top policies for admin overrides (Allow/Block)

Query · kql

EmailEvents  
| where OrgLevelPolicy!="" and OrgLevelAction == "Allow"  //"Block"
| extend OrgPolicy = split(OrgLevelPolicy, "(", 0)
| summarize count() by tostring(OrgPolicy)
| render piechart
Raw source Top policies performing admin overrides · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: c73ae295-d120-4f79-aaed-de005f766ad2
name: Top policies performing admin overrides
description: |
  This query helps in reviewing top policies for admin overrides (Allow/Block)
description-detailed: |
  This query helps in reviewing top policies for admin defined detection overrides (Allow/Block)in Defender for Office 365
  Reference - https://learn.microsoft.com/en-us/defender-office-365/step-by-step-guides/understand-overrides-in-email-entity and https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/email-protection-basics-in-microsoft-365-part-five-mastering/ba-p/4139035
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents  
  | where OrgLevelPolicy!="" and OrgLevelAction == "Allow"  //"Block"
  | extend OrgPolicy = split(OrgLevelPolicy, "(", 0)
  | summarize count() by tostring(OrgPolicy)
  | render piechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.