Post Delivery Events by Admin

Description

This query visualises the daily amount of emails that had an admin post delivery action, summarizing the data by action type

Query · kql

let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
let baseQuery = EmailPostDeliveryEvents
| where Timestamp >= TimeStart
| where ActionTrigger has "AdminAction";
let sdelete=baseQuery
| where Action has 'Soft Delete'
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| extend Details = "Soft Delete";
let hdelete=baseQuery
| where Action has 'Hard Delete'
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| extend Details = "Hard Delete";
let mtojunk=baseQuery
| where Action has 'Moved to junk folder'
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| extend Details = "Moved to junk folder";
let mtoinbox=baseQuery
| where Action has 'Moved to inbox'
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| extend Details = "Moved to inbox";
let qrel=baseQuery
| where Action has 'Quarantine release'
| make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| extend Details = "Quarantine release";
union sdelete,hdelete,mtojunk,mtoinbox,qrel
| project Count, Details, Timestamp
| render timechart
Raw source Post Delivery Events by Admin · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: ee4dc300-5eaa-4cc5-b455-e53cb427e215
name: Post Delivery Events by Admin
description: |
  This query visualises the daily amount of emails that had an admin post delivery action, summarizing the data by action type
description-detailed: |
  This query visualises the daily amount of emails that had an admin post delivery action, summarizing the data by action type
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailPostDeliveryEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  let baseQuery = EmailPostDeliveryEvents
  | where Timestamp >= TimeStart
  | where ActionTrigger has "AdminAction";
  let sdelete=baseQuery
  | where Action has 'Soft Delete'
  | make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | extend Details = "Soft Delete";
  let hdelete=baseQuery
  | where Action has 'Hard Delete'
  | make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | extend Details = "Hard Delete";
  let mtojunk=baseQuery
  | where Action has 'Moved to junk folder'
  | make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | extend Details = "Moved to junk folder";
  let mtoinbox=baseQuery
  | where Action has 'Moved to inbox'
  | make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | extend Details = "Moved to inbox";
  let qrel=baseQuery
  | where Action has 'Quarantine release'
  | make-series Count= count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | extend Details = "Quarantine release";
  union sdelete,hdelete,mtojunk,mtoinbox,qrel
  | project Count, Details, Timestamp
  | render timechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.