id: fc3e5da4-9a8d-4f2f-b714-7118bc00b5d8
name: Top 10 domains sending Bulk email
description: |
This query visualises total inbound emails which has any Bulk complaint level.
description-detailed: |
This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels and SenderFromDomain of the email sender. It provides insights how many messages are detected with each Bulk Complaint level for each sender domain in Microsoft Defender for Office 365.
Taken from the the Microsoft Defender for Office 365 Detections and Insights - Microsoft Sentinel workbook.
https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- EmailEvents
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels and SenderFromDomain of the email sender. It provides insights how many messages are detected with each Bulk Complaint level for each sender domain.
EmailEvents
| where EmailDirection == "Inbound" and BulkComplaintLevel !=""
| where Timestamp > ago(30d) // last 30 days by default, replace 30d with the desired period
| summarize count() by BulkComplaintLevel, SenderFromDomain
| sort by count_ desc
| project SenderFromDomain,BulkComplaintLevel,Emails=count_
| take 10
version: 1.0.0