User Email Submissions (FP) - Top P2 Sender Domains

id: d090ed89-3c2b-4bd7-9b87-d8a5f552e174
name: User Email Submissions (FP) - Top P2 Sender Domains
description: |
  This query visualises the top 10 sender domains of emails submitted as false positives by users.
description-detailed: |
  This query visualises the top 10 sender domains of emails submitted as false positives by users.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "UserSubmission"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType), SubmissionContentType = tostring((parse_json(RawEventData)).SubmissionContentType), P2SenderDomain = tostring((parse_json(RawEventData)).P2SenderDomain)
  | where SubmissionContentType == "Mail" and SubmissionType == "3"
  | summarize count() by P2SenderDomain
  | top 10 by count_
  | project ['Sender Domain'] = P2SenderDomain, ['Emails'] = count_
version: 1.0.0