Top policies performing user overrides

Description

This query helps in reviewing top policies for user overrides (Allow/Block)

Query · kql

EmailEvents  
| where UserLevelPolicy!="" and UserLevelAction == "Allow" //"Block"
| extend UserPolicy = split(UserLevelPolicy, "(", 0)
| summarize count() by tostring(UserPolicy)
| render piechart
Raw source Top policies performing user overrides · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: fe2cb53e-4eb3-4676-87c1-f80d2813f542
name: Top policies performing user overrides
description: |
  This query helps in reviewing top policies for user overrides (Allow/Block)
description-detailed: |
  This query helps in reviewing top policies for user defined detection overrides (Allow/Block)in Defender for Office 365
  Reference - https://learn.microsoft.com/en-us/defender-office-365/step-by-step-guides/understand-overrides-in-email-entity and https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/email-protection-basics-in-microsoft-365-part-five-mastering/ba-p/4139035
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents  
  | where UserLevelPolicy!="" and UserLevelAction == "Allow" //"Block"
  | extend UserPolicy = split(UserLevelPolicy, "(", 0)
  | summarize count() by tostring(UserPolicy)
  | render piechart
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.