Malicious emails detected per day

id: da932998-81dd-4be4-963c-f4890cb4192e
name: Malicious emails detected per day
description: |
  This query helps reviewing Malware, Phishing, Spam emails caught per day
description-detailed: |
  This query helps reviewing Malware, Phishing, Spam emails caught per day in Defender for Office 365
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where DetectionMethods != "" 
  | extend detection= parse_json(DetectionMethods) 
  | extend Spam = tostring(detection.Spam) 
  | extend Phish = tostring(detection.Phish) 
  | extend Malware = tostring(detection.Malware) 
  | where Spam != '' or Phish != '' or Malware != '' 
  | extend detection = case( 
      Malware != "", 'Malware', 
      Phish != "", 'Phish', 
      'Spam') 
  | summarize total=count() by detection, bin(Timestamp, 1d) 
  | order by Timestamp asc
version: 1.0.0