Top 100 senders

Description

This query helps reviewing top 100 senders in your organization in last 30 days

Query · kql

EmailEvents 
| where Timestamp > ago(30d)
| summarize mailCountBySender = count() by SenderMailFromAddress 
| top 100 by mailCountBySender
Raw source Top 100 senders · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: cadf6e78-2a9a-4fb5-b788-30a592d699d3
name: Top 100 senders
description: |
  This query helps reviewing top 100 senders in your organization in last 30 days
description-detailed: |
  This query helps reviewing top 100 senders in your organization in last 30 days using Defender for Office 365 data
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents 
  | where Timestamp > ago(30d)
  | summarize mailCountBySender = count() by SenderMailFromAddress 
  | top 100 by mailCountBySender
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.