Admin Submissions by Submission State (FN)

id: eb1a6d00-aa08-4e27-9eb4-47f4ac37ccb4
name: Admin Submissions by Submission State (FN)
description: |
  This query visualises the total amount of admin false negative submissions by the state of the submission.
description-detailed: |
  This query visualises the total amount of admin false negative submissions by the state of the submission.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType contains "AdminSubmission"
  | extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)
  | where Record == 29 and SubmissionType in ("0","1","2")
  | summarize count() by tostring(SubmissionState)
  | render piechart
version: 1.0.0