Top 10 external senders sending Teams messages

Description

This query visulises all up Top 10 external senders sending Teams messages

Query · kql

//Top 10 external senders sending Teams messages
MessageEvents 
| where IsOwnedThread==0 and IsExternalThread==1
| summarize count() by SenderEmailAddress
| sort by count_ desc
| top 10 by count_
Raw source Top 10 external senders sending Teams messages · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: f143639b-24d5-4089-af92-be8eeea02822
name:  Top 10 external senders sending Teams messages
description: |
  This query visulises all up Top 10 external senders sending Teams messages
description-detailed: |
  This query visulises all up Top 10 external senders sending Teams messages
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
  //Top 10 external senders sending Teams messages
  MessageEvents 
  | where IsOwnedThread==0 and IsExternalThread==1
  | summarize count() by SenderEmailAddress
  | sort by count_ desc
  | top 10 by count_
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.