Total Emails with User Overrides (Allow)

Description

This query visualises the amount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found

Query · kql

EmailEvents
| where UserLevelPolicy != "" and UserLevelAction == "Allow"
| summarize Emails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes
| sort by Emails
// | render columnchart // Uncomment this line to render as a graph
Raw source Total Emails with User Overrides (Allow) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: d7f4b1d0-018f-4033-8618-523bde350d23
name: Total Emails with User Overrides (Allow)
description: |
  This query visualises the amount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found
description-detailed: |
  This query visualises the amount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where UserLevelPolicy != "" and UserLevelAction == "Allow"
  | summarize Emails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes
  | sort by Emails
  // | render columnchart // Uncomment this line to render as a graph
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.