Total number of MDO Teams protection detections daily

id: c7896b13-ae4e-4164-a0a4-fbd43ae85dd4
name:  Total number of MDO Teams protection detections daily
description: |
  This query visulises Total number of MDO Teams protection detections daily 
description-detailed: |
  This query visulises Total number of MDO Teams protection detections daily 
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
 //Total number of MDO Teams protection detections daily 
 let minTime = toscalar(MessageEvents | summarize min(Timestamp));
 let maxTime = toscalar(MessageEvents | summarize max(Timestamp));
 let baseQuery = MessageEvents
 //| where IsOwnedThread==0 and IsExternalThread==1 
 | where isnotempty(Timestamp);
 let totalwiththreat = baseQuery
 | where isnotempty(ThreatTypes) 
 | make-series Count= count() default = 0 on Timestamp from minTime to maxTime step 1d 
 | extend Details = "Total Teams messages with Threat";
 let totalwithphishthreat = baseQuery
 | where ThreatTypes has ('Phish')
 | make-series Count= count() default = 0 on Timestamp from minTime to maxTime step 1d 
 | extend Details = "Total Teams messages with Phish Threat";
 let totalwithmalwarethreat = baseQuery
 | where ThreatTypes has ('Malware')
 | make-series Count= count() default = 0 on Timestamp from minTime to maxTime step 1d 
 | extend Details = "Total Teams messages with Malware Threat";
 union totalwiththreat, totalwithphishthreat, totalwithmalwarethreat
 | project Count, Details, Timestamp
 | render timechart
version: 1.0.0