Email Top 10 Domains sending Spam

id: d5f1f876-9172-4e92-bfae-7ab0f94c9417
name: Email Top 10 Domains sending Spam
description: |
  This query visualises total inbound emails with Spam detections.
description-detailed: |
  This query visualises total inbound emails with Spam detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) in Microsoft Defender for Office 365.
  Taken from the the Microsoft Defender for Office 365 Detections and Insights - Microsoft Sentinel workbook.
  https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query visualises total inbound emails with Spam detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain).
  EmailEvents 
  | where ThreatTypes has "Spam" and EmailDirection =="Inbound"
  | where Timestamp > ago(30d) // last 30 days by default, replace 30d with the desired period
  | summarize count() by SenderFromDomain
  | sort by count_ desc 
  | take 10
  // | render piechart // Uncomment this line to render as a graph
version: 1.0.0