Teams post delivery events daily trend

Description

This query visualizes the daily amount of post delivery events on Teams messages.

Query · kql

//Teams post delivery ZAP events daily trend
let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
MessagePostDeliveryEvents
| where Timestamp >= TimeStart
| where ActionType has "ZAP"
| make-series ZappedTeamsMessages = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| render timechart
Raw source Teams post delivery events daily trend · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: ceea323e-89c9-4594-9fe7-c3075c1b051d
name: Teams post delivery events daily trend
description: |
  This query visualizes the daily amount of post delivery events on Teams messages.
description-detailed: |
  This query visualizes the daily amount of post delivery events on Teams messages.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessagePostDeliveryEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //Teams post delivery ZAP events daily trend
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  MessagePostDeliveryEvents
  | where Timestamp >= TimeStart
  | where ActionType has "ZAP"
  | make-series ZappedTeamsMessages = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | render timechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.