Phish Detections by delivery location trend

id: fbe8abde-83b3-4e16-af08-f8f7db9a9028
name: Phish Detections by delivery location trend
description: |
  This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.
description-detailed: |
  This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.
  The comment in the query excludes deliveries to the SecOps Mailboxes and by the Phish Simulation system. Remove the "//" to apply the exclusion.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  //| where OrgLevelPolicy != "Phishing simulation" and OrgLevelPolicy != "SecOps Mailbox"
  | where DetectionMethods has "Phish" and EmailDirection == "Inbound"
  | make-series TotalPhishDetections=count(),Quarantine = countif(DeliveryLocation == "Quarantine"),Junkfolder=countif(DeliveryLocation == "Junk folder") ,Inbox=countif(DeliveryLocation == "Inbox/folder"),Failed=countif(DeliveryLocation == "Failed"),Dropped=countif(DeliveryLocation == "Dropped") default = 0 on Timestamp step 1d
  | render timechart
version: 1.0.0