{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "\n\n \n \n \n \n
\n Microsoft Defender for Office 365 Detections and Insights\n \n \n\t
\n\n\n\n\n
This workbook template provides an example of how to visualise and gain insights into Microsoft Defender for Office 365.
It allows you to visualise Microsoft Defender for Office 365 (MDO) data based on your organisation needs.
The workbook uses data from hunting tables streamed from Microsoft Defender XDR via the Microsoft Sentinel Connector. Keep the data in the Log Analytics workspace for as long as necessary to get insights over an extended period, based on your organisation's needs.
\n\n> \n**Please note:** *The workbook has a total of 14 tabs. If not all tabs are visible, you can access the remaining tabs using the \"...\" located at the end of the tab list on the right side.*\n> \n\n---\n\n\n\n> **Multi-tenant / multi-workspace:** select one or more workspaces in the **Workspace** filter to view data across them in a single view. For cross-tenant (MSSP) scenarios, onboard customer tenants with **Azure Lighthouse** (their workspaces then appear in the selectors) or use **Microsoft Defender multi-tenant management** in the Defender portal. For performance, keep to ~5–10 workspaces per view." }, "name": "text - 2", "id": "d2b45ab8-a1c1-43d2-853d-290640bf4c94" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "b52e081b-490e-4f30-a6e8-d047ec40df7c", "version": "KqlParameterItem/1.0", "name": "DefaultSubscription_Internal", "type": 1, "isRequired": true, "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId", "crossComponentResources": [ "value::all" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "fdc46b38-9d1e-42ac-9277-c6ff62e9ccc6", "version": "KqlParameterItem/1.0", "name": "DefaultWorkspace_Internal", "type": 1, "query": "resources\r\n| where type =~ 'microsoft.operationsmanagement/solutions'\r\n| where name contains 'SecurityInsights'\r\n| project workspaceId = tostring(properties.workspaceResourceId)\r\n| take 1", "crossComponentResources": [ "value::all" ], "isHiddenWhenLocked": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "6e647d99-1a32-4bca-8147-403b5d37d773", "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| distinct subscriptionId, location\r\n| summarize by value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n| order by value asc", "crossComponentResources": [ "value::all" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "d57bcdf5-aec7-4f86-904c-67171864919b", "version": "KqlParameterItem/1.0", "name": "Workspace", "type": 5, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "resources | where type =~ 'Microsoft.operationsmanagement/solutions' | where name contains 'SecurityInsights' \r\n| parse name with \"SecurityInsights(\" label \")\" \r\n| project id = tostring(properties.workspaceResourceId), label, selected = iff(id =~ '{DefaultWorkspace_Internal}', true, false)", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true }, "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": "" }, { "id": "2e238f92-709c-410b-93e0-60eab6150a75", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "isGlobal": true, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 7776000000 }, "key": "2e238f92-709c-410b-93e0-60eab6150a75" }, { "id": "165f2f4a-e49f-4561-adc5-d0527a4caf32", "version": "KqlParameterItem/1.0", "name": "Granularity", "label": "Trend interval", "type": 2, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[{ \"value\": \"1d\", \"label\": \"Daily (1d)\", \"selected\": true }, { \"value\": \"7d\", \"label\": \"Weekly (7d)\" }, { \"value\": \"30d\", \"label\": \"Monthly (30d)\" }, { \"value\": \"90d\", \"label\": \"Quarterly (90d)\" }]", "timeContext": { "durationMs": 86400000 }, "value": "1d" } ], "style": "pills" }, "name": "parameters - 1", "id": "0021e733-42b4-461f-8f6c-14e6e765389d" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "3d26d949-bba8-486c-9af7-2b85bd5c8ab0", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Executive Summary", "subTarget": "1", "style": "link", "key": "3d26d949-bba8-486c-9af7-2b85bd5c8ab0" }, { "id": "a5f95467-84c1-4d8b-858c-7819339af748", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Email - Malware", "subTarget": "2", "style": "link", "key": "a5f95467-84c1-4d8b-858c-7819339af748" }, { "id": "b6c93de8-16d9-4c90-999b-837935de5645", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Email - Phish", "subTarget": "3", "style": "link", "key": "b6c93de8-16d9-4c90-999b-837935de5645" }, { "id": "9e006e81-4fd4-40b9-9d20-3705dd6c17ad", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Email - Impersonation & BEC", "subTarget": "15", "style": "link", "key": "75f1e28f-e95a-4810-af40-6b47b35cda46" }, { "id": "df2c53b4-b6ed-4151-95fb-b3f08b849b84", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Email - Spam", "subTarget": "4", "style": "link", "key": "df2c53b4-b6ed-4151-95fb-b3f08b849b84" }, { "id": "fd2006c9-39b5-43ac-b05d-47309ee22deb", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Teams & Collaboration", "subTarget": "14", "style": "link", "key": "fd2006c9-39b5-43ac-b05d-47309ee22deb" }, { "id": "ee01f95a-c5f7-4864-82e8-54a164741ba2", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "File - Malware (SharePoint, Teams and OneDrive)", "subTarget": "9", "style": "link", "key": "ee01f95a-c5f7-4864-82e8-54a164741ba2" }, { "id": "9df30067-3266-48a8-b9e3-d65952098d46", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "URL & Clicks", "subTarget": "5", "style": "link", "key": "9df30067-3266-48a8-b9e3-d65952098d46" }, { "id": "b4be0ac3-3f48-44a8-b4b6-b46e17c710cd", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Top Users & Exfiltration", "subTarget": "6", "style": "link", "key": "b4be0ac3-3f48-44a8-b4b6-b46e17c710cd" }, { "id": "e1d34091-7b3c-4e2d-a032-8be82a989313", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Email - Detection Overrides", "subTarget": "7", "style": "link", "key": "e1d34091-7b3c-4e2d-a032-8be82a989313" }, { "id": "a1e6264d-8f85-4a94-9ffd-eee36c04a0d5", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Post-Delivery & Quarantine", "subTarget": "11", "style": "link", "key": "a1e6264d-8f85-4a94-9ffd-eee36c04a0d5" }, { "id": "08c43a4f-f502-4813-9b8d-3f6b0b62b2fd", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "False Negative(FN) Submissions", "subTarget": "8", "style": "link", "key": "08c43a4f-f502-4813-9b8d-3f6b0b62b2fd" }, { "id": "638d931f-f319-4914-b72d-8d68e914c7d4", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "False Positive(FP) Submissions", "subTarget": "10", "style": "link", "key": "638d931f-f319-4914-b72d-8d68e914c7d4" }, { "id": "b2920bee-c32a-4fdd-9d32-b004db2f3ac8", "cellValue": "Tab", "linkTarget": "parameter", "linkLabel": "Security Operations Center (SOC) Insights", "subTarget": "13", "style": "link", "key": "b2920bee-c32a-4fdd-9d32-b004db2f3ac8" } ] }, "name": "links - 14", "id": "5c9a1d6b-c248-432b-a1c0-496337635775" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Defender for Office 365 - Protection Insights\r\n
\r\n\r\n**Microsoft Defender for Office 365** is a comprehensive security solution designed to protect organizations from advanced threats targeting their email and collaboration tools. It leverages a multi-layered approach to safeguard against phishing, malware, business email compromise (BEC), and other sophisticated attacks.\r\n" }, "name": "text - 13", "styleSettings": { "margin": "0", "padding": "0" }, "id": "46119f93-fad9-413c-8e10-7615c6fdde2f" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n\r\n// Get all mailflow detected as clean at time of delivery \r\nlet EmailEventsClean = materialize( \r\n EmailEvents \r\n | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\r\n // this alteration is due to the threat types being updated directly within advanced hunting.\r\n //| where DeliveryLocation != \"Quarantine\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\r\n | project NetworkMessageId,ThreatTypes \r\n); \r\n// Get all mailflow detected as phish or malware at time of delivery \r\nlet EmailEventsThreats = materialize( \r\n EmailEvents \r\n | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n | where ThreatTypes contains \"Phish\" or ThreatTypes contains \"Malware\" \r\n | extend MDO_detection = parse_json(DetectionMethods) \r\n | extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n | extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \r\n); \r\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \r\nlet EmailPostDeliveryFiltered = materialize( \r\n EmailPostDeliveryEvents \r\n | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \r\n | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") or Action has_any (\"Redelivery\",\"Reprocessed\") \r\n | extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n | summarize arg_max(Timestamp, *) by Key \r\n | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \r\n); \r\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \r\nlet CloudAppEventsFiltered = materialize( \r\n CloudAppEvents \r\n | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\r\n | where ActionType == \"AdminSubmissionSubmitted\" \r\n | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \r\n | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \r\n | where SubmissionType in (\"1\", \"2\") \r\n | project SubmissionType,NetworkMessageId \r\n); \r\n// get the number of threats caught in mailflow \r\nlet Mal_Phish_Mailflow = toscalar( \r\n EmailEventsThreats \r\n | summarize count() \r\n); \r\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \r\nlet FP_ZAP = toscalar( \r\n EmailPostDeliveryFiltered \r\n | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" and Action has_any (\"Redelivery\",\"Reprocessed\") \r\n | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \r\n | summarize count() \r\n); \r\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \r\nlet FN_ZAP_Successful = toscalar( \r\n EmailPostDeliveryFiltered \r\n | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult in (\"Success\",\"AdminPolicy\") \r\n | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n | summarize count() \r\n); \r\n// get the number of threats unsuccessfully cleaned up post delivery. \r\nlet FN_ZAP_Unsuccessful = toscalar( \r\n EmailPostDeliveryFiltered \r\n | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult !in (\"Success\",\"AdminPolicy\") \r\n | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n | summarize count() \r\n); \r\n// join the administrative submissions to clean mailflow to find the additional miss \r\nlet FN_Admin_Submissions = toscalar( \r\n CloudAppEventsFiltered \r\n | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \r\n | summarize count() \r\n ); \r\n // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \r\n\r\nprint StatisticName=\"Effectiveness Post Delivery\", Value=abs(round(((toreal(toscalar(FN_Admin_Submissions))+toreal(toscalar(FN_ZAP_Unsuccessful)))/(toreal(toscalar(Mal_Phish_Mailflow))+toreal(toscalar(FN_ZAP_Successful))+toreal(toscalar(FN_ZAP_Unsuccessful))+toreal(toscalar(FN_Admin_Submissions))-toreal(toscalar(FP_ZAP)))*100-100),2))", "size": 1, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "stat", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "StatisticName", "formatter": 1 }, "leftContent": { "columnMatch": "Value", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "StatisticName", "formatter": 1 }, "centerContent": { "columnMatch": "Value", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "statSettings": { "valueField": "Value", "valueAggregation": "None", "colorSettings": { "type": "thresholds", "mode": "foreground", "heatmapPalette": "greenRed", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "95", "representation": "green" }, { "operator": "<=", "thresholdValue": "95", "representation": "orange" }, { "operator": "<=", "thresholdValue": "90", "representation": "red" } ] }, "iconSettings": { "thresholdsGrid": [] }, "numberFormatSettings": { "unit": 1, "options": { "style": "decimal" } }, "tagText": "Phish / Malware Effectiveness - Post Delivery", "valueFontStyle": "superLarge", "tagTextPosition": "bottom" } }, "customWidth": "50", "name": "query - 5", "id": "62de2a91-a809-48ec-a111-e697d556b2b3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\r\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\r\n| where Action == \"Quarantine release\"\r\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \"Quarantine\") on NetworkMessageId\r\n| summarize count());\r\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \"Quarantine\"\r\n| summarize count());\r\nprint\r\nQuarantine_Releases = toreal(Quarantine_Releases),\r\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\r\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))", "size": 1, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "stat", "tileSettings": { "titleContent": { "columnMatch": "Release_Percentage", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, "showBorder": true, "sortCriteriaField": "Release_Percentage", "size": "auto" }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "StatisticName", "formatter": 1 }, "centerContent": { "columnMatch": "Value", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "statSettings": { "valueField": "Release_Percentage", "valueAggregation": "None", "colorSettings": { "type": "thresholds", "mode": "foreground", "heatmapPalette": "greenRed", "thresholdsGrid": [ { "operator": "<", "thresholdValue": "5", "representation": "green" }, { "operator": ">", "thresholdValue": "5", "representation": "redDark" } ] }, "iconSettings": { "thresholdsGrid": [] }, "numberFormatSettings": { "unit": 1, "options": { "style": "decimal" } }, "tagText": "Quarantine Release Percentage", "valueFontStyle": "superLarge", "tagTextPosition": "bottom" } }, "customWidth": "50", "name": "query - 1", "id": "858ac1a4-8828-45e9-968c-d3cfc1216c64" } ] }, "name": "TopNr", "id": "1369c97e-848b-475a-b447-3a435cb7a1f1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "**Effectiveness visually represents the protection given by Defender for Office 365 against phishing and malware in email messages.**
\r\nWe consider messages that your users report, as well as decisions that are made after delivery." }, "name": "text - 9", "styleSettings": { "margin": "1px" }, "id": "25e2e19e-aefb-4e37-b28f-b4138d63e109" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n\r\n// Get all mailflow detected as clean at time of delivery \r\nlet EmailEventsClean = materialize( \r\n EmailEvents \r\n | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\r\n // this alteration is due to the threat types being updated directly within advanced hunting.\r\n //| where DeliveryLocation != \"Quarantine\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\r\n | project NetworkMessageId,ThreatTypes \r\n); \r\n// Get all mailflow detected as phish or malware at time of delivery \r\nlet EmailEventsThreats = materialize( \r\n EmailEvents \r\n | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n | where ThreatTypes contains \"Phish\" or ThreatTypes contains \"Malware\" \r\n | extend MDO_detection = parse_json(DetectionMethods) \r\n | extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n | extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \r\n); \r\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \r\nlet EmailPostDeliveryFiltered = materialize( \r\n EmailPostDeliveryEvents \r\n | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \r\n | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") or Action has_any (\"Redelivery\",\"Reprocessed\") \r\n | extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n | summarize arg_max(Timestamp, *) by Key \r\n | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \r\n); \r\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \r\nlet CloudAppEventsFiltered = materialize( \r\n CloudAppEvents \r\n | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\r\n | where ActionType == \"AdminSubmissionSubmitted\" \r\n | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \r\n | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \r\n | where SubmissionType in (\"1\", \"2\") \r\n | project SubmissionType,NetworkMessageId \r\n); \r\n// get the number of threats caught in mailflow \r\nlet Mal_Phish_Mailflow = toscalar( \r\n EmailEventsThreats \r\n | summarize count() \r\n); \r\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \r\nlet FP_ZAP = toscalar( \r\n EmailPostDeliveryFiltered \r\n | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" and Action has_any (\"Redelivery\",\"Reprocessed\") \r\n | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \r\n | summarize count() \r\n); \r\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \r\nlet FN_ZAP_Successful = toscalar( \r\n EmailPostDeliveryFiltered \r\n | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult in (\"Success\",\"AdminPolicy\") \r\n | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n | summarize count() \r\n); \r\n// get the number of threats unsuccessfully cleaned up post delivery. \r\nlet FN_ZAP_Unsuccessful = toscalar( \r\n EmailPostDeliveryFiltered \r\n | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult !in (\"Success\",\"AdminPolicy\") \r\n | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n | summarize count() \r\n); \r\n// join the administrative submissions to clean mailflow to find the additional miss \r\nlet FN_Admin_Submissions = toscalar( \r\n CloudAppEventsFiltered \r\n | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \r\n | summarize count() \r\n ); \r\n // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \r\nunion withsource=Table \r\n (print StatisticName=\"Mal/Phish Mailflow totals - Minus FPs\", Value=toreal(Mal_Phish_Mailflow) - toreal(FP_ZAP)), \r\n (print StatisticName=\"Admin Mal/Phish FNs Submitted\", Value=toreal(FN_Admin_Submissions)), \r\n (print StatisticName=\"Mal/Phish FPs Reverse Zapped\", Value=toreal(FP_ZAP)), \r\n (print StatisticName=\"Mal / Phish Successfully Zapped\", Value=toreal(FN_ZAP_Successful)), \r\n (print StatisticName=\"Mal / Phish UN-Successfully Zapped\", Value=toreal(FN_ZAP_Unsuccessful)), \r\n (print StatisticName=\"Effectiveness Post Delivery (%)\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))), \r\n (print StatisticName=\"Effectiveness Pre-Delivery (%)\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_ZAP_Successful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))) \r\n| project StatisticName, Value", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Value", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ] }, "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "StatisticName", "formatter": 1 }, "leftContent": { "columnMatch": "Value", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 2, "topContent": { "columnMatch": "StatisticName", "formatter": 1 }, "centerContent": { "columnMatch": "Value", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "StatisticName", "sourceIdField": "Value", "targetIdField": "Value", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5, "edgeColorSettings": null } }, "name": "query - 7", "id": "9e09ff94-8092-49c7-860f-341049e1398c" } ] }, "customWidth": "50", "name": "Effectiveness Nr", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "31081a73-9a54-4668-9e26-ad7347f1e06e" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "**Quarantine release rate by detection technology.** \r\n
\r\nFor each detector, the share of its quarantined mail that was later released (Release % = released / quarantined). A high rate can indicate false positives worth reviewing." }, "name": "text - 1", "styleSettings": { "margin": "1px" }, "id": "e9848043-03dd-4ada-9e73-238067463f74" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Per detection technology: the share of its quarantined emails later released from quarantine (a high rate can indicate false positives). Top 7 by release rate; detectors with <10 quarantined excluded so the rate is meaningful.\r\nEmailEvents\r\n| where DeliveryLocation == \"Quarantine\"\r\n| extend MDO_detection = parse_json(DetectionMethods)\r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\")\r\n| where FirstSubcategory contains \"Malware\" or FirstSubcategory contains \"Phish\"\r\n| join kind=leftouter (\r\n EmailPostDeliveryEvents\r\n | where Action == \"Quarantine release\"\r\n | distinct NetworkMessageId\r\n | extend ReleasedFlag = \"yes\"\r\n ) on NetworkMessageId\r\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \"yes\") by FirstSubcategory\r\n| where Quarantined >= 10 and Released > 0\r\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\r\n| project ['Detection Technology']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\r\n| order by ['Release %'] desc\r\n| take 7", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Quarantined Emails", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Released", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "90px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Release %", "formatter": 4, "formatOptions": { "palette": "red", "min": 0, "max": 20, "customColumnWidthSetting": "90px" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "filter": true } }, "name": "query - 2", "id": "1bbae9d1-d6f8-446a-817c-8fdc2df83d4c" } ] }, "customWidth": "50", "name": "Quarantine Overview Relese", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "36fd8f20-ece7-4889-9fb1-f5b85b97b45a" } ] }, "customWidth": "100", "name": "group - Exec Protection Insights", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "1d8e22e0-22f7-453e-aed2-9e56ace1363a" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Protection details\r\n
\r\n\r\nThis Overview provides an executive summary of your Microsoft Defender for Office 365 email security posture: the volume of mail processed, threats detected and filtered (phishing, malware, spam), overall protection effectiveness, and the mix of threats targeting your organization. Use it as a starting point, then drill into the dedicated tabs for detailed investigation." }, "name": "text - 13", "id": "24cf577c-e12a-4747-95a7-1c19bee17397" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "5c0f0101-0a11-4b22-9c33-000000000101", "version": "KqlParameterItem/1.0", "name": "ProtectionView", "label": "Protection view", "type": 2, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[{ \"value\": \"Table\", \"label\": \"Summary table\", \"selected\": true }, { \"value\": \"Tiles\", \"label\": \"Detailed tiles\" }]", "value": "Tiles" } ], "style": "pills" }, "name": "Protection view selector", "id": "5c0f0102-0a11-4b22-9c33-000000000102" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let base = materialize(EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize arg_max(Timestamp, ThreatTypes, DeliveryAction, OrgLevelPolicy, OrgLevelAction, UserLevelAction) by Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress));\r\nlet agg = materialize(base | summarize\r\n Total = count(),\r\n Filtered = countif(isnotempty(ThreatTypes) and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n FMal = countif(ThreatTypes has \"Malware\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n FPhish = countif(ThreatTypes has \"Phish\" and not(ThreatTypes has \"Malware\") and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n FSpam = countif(ThreatTypes == \"Spam\" and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n Deliv = countif(isnotempty(ThreatTypes) and DeliveryAction == \"Delivered\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\r\n Blocked = countif(isempty(ThreatTypes) and DeliveryAction != \"Delivered\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\r\n Clean = countif(isempty(ThreatTypes) and DeliveryAction == \"Delivered\"));\r\nlet pd = materialize(EmailPostDeliveryEvents | where ActionResult == \"Success\" | summarize MalZap = countif(ActionType == \"Malware ZAP\"), PhishZap = countif(ActionType == \"Phish ZAP\"), SpamZap = countif(ActionType == \"Spam ZAP\"));\r\nlet sub = materialize(CloudAppEvents | extend R = tostring(parse_json(RawEventData).RecordType), SCT = tostring(parse_json(RawEventData).SubmissionContentType) | where R == \"29\" | summarize Adm = countif(ActionType == \"AdminSubmissionSubmitted\" and SCT == \"Mail\"), Usr = countif(ActionType == \"UserSubmission\"));\r\nlet Total = toscalar(agg | project Total);\r\nlet Filtered = toscalar(agg | project Filtered);\r\nlet FMal = toscalar(agg | project FMal);\r\nlet FPhish = toscalar(agg | project FPhish);\r\nlet FSpam = toscalar(agg | project FSpam);\r\nlet Deliv = toscalar(agg | project Deliv);\r\nlet Blocked = toscalar(agg | project Blocked);\r\nlet Clean = toscalar(agg | project Clean);\r\nlet MalZap = toscalar(pd | project MalZap);\r\nlet PhishZap = toscalar(pd | project PhishZap);\r\nlet SpamZap = toscalar(pd | project SpamZap);\r\nlet Adm = toscalar(sub | project Adm);\r\nlet Usr = toscalar(sub | project Usr);\r\nunion\r\n (print o = 1, Name = \"Total Inbound Emails\", Count = Total),\r\n (print o = 2, Name = \"    Filtering Totals\", Count = Filtered),\r\n (print o = 3, Name = \"        Filtered as Malware\", Count = FMal),\r\n (print o = 4, Name = \"        Filtered as Phish\", Count = FPhish),\r\n (print o = 5, Name = \"        Filtered as Spam\", Count = FSpam),\r\n (print o = 6, Name = \"    Delivered with Detection\", Count = Deliv),\r\n (print o = 7, Name = \"    User/Admin Blocked\", Count = Blocked),\r\n (print o = 8, Name = \"    Clean Emails\", Count = Clean),\r\n (print o = 9, Name = \"Post-Delivery ZAP Removals\", Count = MalZap + PhishZap + SpamZap),\r\n (print o = 10, Name = \"    Removed by Malware ZAP\", Count = MalZap),\r\n (print o = 11, Name = \"    Removed by Phish ZAP\", Count = PhishZap),\r\n (print o = 12, Name = \"    Removed by Spam ZAP\", Count = SpamZap),\r\n (print o = 13, Name = \"User/Admin Reported\", Count = Adm + Usr),\r\n (print o = 14, Name = \"    Reported by Admins\", Count = Adm),\r\n (print o = 15, Name = \"    Reported by Users\", Count = Usr)\r\n| sort by o asc\r\n| extend [\"% of Inbound\"] = round(Count * 100.0 / Total, 1)\r\n| project Name, Count, [\"% of Inbound\"]", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Name", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "3fr" } }, { "columnMatch": "Count", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "3fr" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "% of Inbound", "formatter": 3, "formatOptions": { "palette": "green", "min": 0, "max": 100, "customColumnWidthSetting": "2fr" }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "ProtectionView", "comparison": "isEqualTo", "value": "Table" }, "name": "query - option 1 grid", "id": "5c0f0005-0a11-4b22-9c33-000000000005" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Total Emails", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count = count()\r\n| extend Details = \"Total Inbound Emails\";", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "palette": "greenRed" } } ] }, "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1, "formatOptions": { "compositeBarSettings": { "labelText": "" } } }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 1, "palette": "blue", "compositeBarSettings": { "labelText": "" } }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full", "styleSettings": { "borderStyle": "rounded", "backgroundColor": "colorGray100" } }, "chartSettings": { "xAxis": "Count", "createOtherGroup": 0 }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Count", "sizeAggregation": "Sum", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Count", "heatmapPalette": "greenRed" } } }, "name": "query - 1", "id": "84e8d60b-7937-46f5-b2f4-a1a4adf06c9f" } ] }, "name": "Total Inbound", "id": "1aeed046-9ea5-4583-b966-722847997fc7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Filtering Totals", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EmailEvents\r\n| where isnotempty(ThreatTypes) and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count = count()\r\n| extend Details = \"Filtering Totals\";", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1, "formatOptions": { "compositeBarSettings": { "labelText": "" } } }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 1, "palette": "redDark", "compositeBarSettings": { "labelText": "" } }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full", "styleSettings": { "borderStyle": "rounded", "backgroundColor": "colorGray100" } } }, "name": "query - 1", "id": "bae9a200-589f-4ca6-a3cf-f1110f644c49" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises Total emails detected as Malware\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes has ('Malware') and EmailDirection == \"Inbound\"\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Malware\"", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 1, "palette": "red" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full", "styleSettings": { "borderStyle": "rounded", "backgroundColor": "colorGray100" } } }, "customWidth": "33.3", "name": "query - 4", "id": "0984d05b-fd2c-48e1-835f-41afc5a2385a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises Total emails detected as Phish\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes has \"Phish\" and not(ThreatTypes has \"Malware\") and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Phish\"", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 1, "palette": "orange" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full", "styleSettings": { "borderStyle": "rounded", "backgroundColor": "colorGray100" } } }, "customWidth": "33.3", "name": "query - 4", "id": "ced2d054-76d1-40df-a412-0bc86a6c3336" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises Total emails by detected as Spam\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes == 'Spam' and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Spam\"", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 1, "palette": "yellow" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full", "styleSettings": { "borderStyle": "rounded", "backgroundColor": "colorGray100" } } }, "customWidth": "33.3", "name": "query - 4", "id": "14456a0d-f5ac-46a0-a007-c72c7c40c58f" } ] }, "customWidth": "50", "name": "group - 9", "id": "d4e69885-f1b2-4c2b-85c2-188a6708dc4b" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": " ", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and DeliveryAction == 'Delivered'\r\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count= count()\r\n| extend Details = \"Delivered with Detection\"", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "red" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full", "styleSettings": { "borderStyle": "rounded", "backgroundColor": "colorGray100" } } }, "customWidth": "33.3", "name": "query - 3", "id": "394d1ed4-7089-4291-bc80-f9948e3be6a9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isempty(ThreatTypes) \r\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\r\n| where DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"User/Admin Blocked\"", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 1, "palette": "gray" }, "tooltipFormat": { "tooltip": "Emails blocked from being delivered because of User or Admin overriddes" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full", "styleSettings": { "borderStyle": "rounded", "backgroundColor": "colorGray100" } } }, "customWidth": "33.3", "name": "query - 3", "id": "c29a2268-67d1-4958-a9a3-696384075987" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EmailEvents\r\n| where isempty(ThreatTypes) and EmailDirection == \"Inbound\" and DeliveryAction == 'Delivered'\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count= count()\r\n| extend Details = \"Clean Emails\"", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 1, "palette": "gray" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full", "styleSettings": { "borderStyle": "rounded", "backgroundColor": "colorGray100" } } }, "customWidth": "33.3", "name": "query - 3", "id": "89a02ac7-971c-4672-bf5d-64709c479536" } ] }, "customWidth": "50", "name": "group - 8", "id": "761e74d4-279e-465f-ba47-5eeec4cf05d2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Post-Delivery ZAP Removals", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Malware ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Malware ZAP\"\r\n", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 1, "palette": "red" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full", "styleSettings": { "borderStyle": "rounded", "backgroundColor": "colorGray100" } } }, "customWidth": "33.3", "name": "query - 3", "id": "b06666bc-6ec0-49e7-a332-77e278d2320f" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Phish ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Phish ZAP\"", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 1, "palette": "orange" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full", "styleSettings": { "borderStyle": "rounded", "backgroundColor": "colorGray100" } } }, "customWidth": "33.3", "name": "query - 3", "id": "6fbac01b-0c42-46dc-8ca8-68e285593a45" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Spam ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Spam ZAP\"", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 1, "palette": "yellow" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full", "styleSettings": { "borderStyle": "rounded", "backgroundColor": "colorGray100" } } }, "customWidth": "33.3", "name": "query - 3", "id": "7bd27a3b-be13-4ca0-9964-0f872f826b45" } ] }, "name": "Post Delivery", "id": "4d20339e-5215-4edf-99d6-728cac183d16" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\r\nCloudAppEvents\r\n| extend Record= (parse_json(RawEventData)).RecordType\r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Reported by Admins\"", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full", "styleSettings": { "borderStyle": "rounded", "backgroundColor": "colorGray100" } } }, "customWidth": "50", "name": "query - 3", "id": "7490fa3a-e287-4fc3-b025-8772b9edb601" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\r\nCloudAppEvents\r\n| extend Record= (parse_json(RawEventData)).RecordType\r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\r\n| where Record == 29 and ActionType == \"UserSubmission\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Reported by Users\"\r\n", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full", "styleSettings": { "borderStyle": "rounded", "backgroundColor": "colorGray100" } } }, "customWidth": "50", "name": "query - 2", "id": "7af222dc-fd74-40ec-8ab7-741e179c07bf" } ] }, "name": "Reported", "id": "8151e242-1c30-4550-ae9c-83f159e1a456" } ] }, "conditionalVisibility": { "parameterName": "ProtectionView", "comparison": "isEqualTo", "value": "Tiles" }, "name": "Protection - Tiles view", "id": "5c0f0103-0a11-4b22-9c33-000000000103" }, { "type": 1, "content": { "json": "## Most Attacked Users
\r\n\r\n**The users most targeted by inbound email threats across all threat types (malware, phishing, and spam) in the selected period. Concentrated targeting of a few individuals is a strong signal of deliberate campaigns.**

**Recommended action:** Prioritise these users for security awareness training, tighter protection policies (for example the Strict preset), and closer monitoring - they are your highest-risk people." }, "name": "exec vap banner", "id": "1fe431fb-cc96-4e81-b164-3a1a3823ebeb" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query surfaces the users most targeted by inbound email threats across all threat types (malware, phishing, spam) for the selected period, so SecOps can prioritise the highest-risk individuals. Similar to a \"Most Attacked People\" view.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where isnotempty(ThreatTypes)\r\n| summarize\r\n ['Total Threats'] = count(),\r\n Malware = countif(ThreatTypes has \"Malware\"),\r\n Phish = countif(ThreatTypes has \"Phish\"),\r\n Spam = countif(ThreatTypes has \"Spam\"),\r\n ['Last Seen'] = max(Timestamp)\r\n by ['User']=RecipientEmailAddress\r\n| top 10 by ['Total Threats']\r\n| project ['User'], ['Total Threats'], Malware, Phish, Spam, ['Last Seen']", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "Malware", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "145px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Phish", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "145px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Spam", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "145px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Total Threats", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "145px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] } }, "customWidth": "100", "name": "exec vap table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "2dfd91b1-b8d3-4a72-aaf4-a30a1886bed7" }, { "type": 1, "content": { "json": "## Detection trend over time - grouped by {Granularity}\r\n**Represents total emails, total detections, total user submissions and admin email submissions over time summarizing the data per {Granularity} interval**" }, "name": "text - 14", "id": "ddbbdaef-b374-42a8-821c-7fcd7ee53ba9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails, total detections, total user, and admin email submissions over time summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet scaffold = range Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran;\r\nlet baseQuery = materialize(EmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where isnotempty(Timestamp));\r\nlet sub = materialize(CloudAppEvents\r\n| extend Record = (parse_json(RawEventData)).RecordType, SubmissionContentType = tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29);\r\nlet zapbase = EmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Phish ZAP\" or ActionType == \"Malware ZAP\" or ActionType == \"Spam ZAP\";\r\nunion\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Inbound\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Inbound Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Phish') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Phish\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Malware') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Malware\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Spam') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Spam\"),\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Intra-org\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Intra-org Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Outbound\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Outbound Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where isnotempty(ThreatTypes) | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails with Threat\"),\r\n(scaffold | join kind=leftouter (sub | where ActionType == \"UserSubmission\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Reported by Users\"),\r\n(scaffold | join kind=leftouter (zapbase | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Removed by ZAP\"),\r\n(scaffold | join kind=leftouter (sub | where ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType == \"Mail\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Reported by Admins\")", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "xAxis": "Timestamp", "seriesLabelSettings": [ { "seriesName": "Total Inbound Emails", "label": "Inbound Emails", "color": "green" }, { "seriesName": "Total Emails with Threat", "label": "Emails with Threat", "color": "redDark" }, { "seriesName": "Emails Detected as Phish", "label": "Emails with Phish", "color": "redBright" }, { "seriesName": "Emails Detected as Malware", "label": "Emails with Malware", "color": "red" }, { "seriesName": "Total Intra-org Emails", "label": "Intra-org Emails", "color": "greenDark" }, { "seriesName": "Emails Detected as Spam", "label": "Emails with Spam", "color": "gray" }, { "seriesName": "Total Outbound Emails", "label": "Outbound Emails", "color": "greenDarkDark" }, { "seriesName": "Total Emails Removed by ZAP", "label": "Emails ZAP-d", "color": "orangeDark" }, { "seriesName": "Total Emails Reported by Users", "label": "User Reported Emails", "color": "lightBlue" }, { "seriesName": "Total Emails Reported by Admins", "color": "blueDark" } ] } }, "customWidth": "100", "name": "query - 1", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "bcbefa48-f553-4290-acff-2691caf898ea" }, { "type": 1, "content": { "json": "## Bad traffic (%) - Inbound Emails - grouped by {Granularity}\r\n**This represents bad traffic (% of emails with threats) compared to total inbound emails, summarized per {Granularity} interval over time.**" }, "name": "text - 15", "id": "30761bcc-b1a5-45e2-8c0a-22388fbbf16c" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n BadEmailCount = countif(isnotempty(ThreatTypes)) by bin(Timestamp, {Granularity})\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(BadEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| project Timestamp, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound", "size": 0, "aggregation": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "customWidth": "100", "name": "query - 4", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "508036a8-d969-44c2-b2d2-c62d99999197" } ] }, "customWidth": "100", "name": "group - Exec Protection Details", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "e6edeeeb-dcde-41d0-88c7-97ef773403b1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Collaboration Protection Posture\r\n
\r\n\r\nMicrosoft Defender for Office 365 protects Microsoft Teams and collaboration, not only email. This snapshot shows Teams threat activity for the period.

**Recommended action:** Review the dedicated **Teams & Collaboration** tab for impersonation, malicious URLs, risky senders and file threats in Teams." }, "name": "exec collab banner", "id": "3d78a6aa-51d4-4cab-93d1-26dff86fd667" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Headline Microsoft Teams / collaboration protection metrics for the executive summary, with per-interval sparklines so the collaboration threat trend is visible at a glance. Messages and URLs are counted per distinct Teams message.\r\nlet gran = {Granularity};\r\nlet me = materialize(MessageEvents);\r\nlet cae = materialize(CloudAppEvents | where ActionType == \"TeamsImpersonationDetected\");\r\nlet mui = materialize(MessageUrlInfo);\r\nlet uce = materialize(UrlClickEvents | where Workload == \"Teams\" and ActionType in (\"ClickBlocked\",\"ClickBlockedByTenantPolicy\"));\r\nlet fmc = materialize(FileMaliciousContentInfo | where Workload == \"MicrosoftTeams\");\r\nunion\r\n(me | summarize Count = dcount(TeamsMessageId) | extend Details = \"Teams Messages Scanned\", Ord = 1, Trend = toscalar(me | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(me | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Teams Threat Messages\", Ord = 2, Trend = toscalar(me | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(cae | summarize Count = count() | extend Details = \"Teams Impersonation Detections\", Ord = 3, Trend = toscalar(cae | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(mui | summarize Count = dcount(TeamsMessageId) | extend Details = \"URLs Shared in Teams\", Ord = 4, Trend = toscalar(mui | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(uce | summarize Count = count() | extend Details = \"Malicious Clicks Blocked\", Ord = 5, Trend = toscalar(uce | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(fmc | summarize Count = count() | extend Details = \"Teams Files Scanned\", Ord = 6, Trend = toscalar(fmc | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(fmc | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Malicious Teams Files\", Ord = 7, Trend = toscalar(fmc | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 21 }, "showBorder": true, "size": "auto" } }, "customWidth": "100", "name": "exec collab tiles", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "3175aee5-56d2-4cb1-b1c3-75be683e6ffb" } ] }, "customWidth": "100", "name": "group - Exec Collaboration Posture", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "39b0921f-fcef-49f4-8d52-0dcd1f33045b" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Emerging Threats\r\n
\r\n\r\n

With more sophisticated adversaries and new threats emerging frequently and prevalently, it's critical to be able to quickly identify and react to these threats.

\r\n\r\n[

🛡️Activity Profile: Email threat landscape

](https://security.microsoft.com/threatanalytics3/f186e4b0-28df-499a-901e-c64768b6d0dc/overview?filters=tags%253DPhishing)\r\n[

🛡️Activity Profile: Automated business email impersonation campaign uses parallel aging report and payroll diversion lures

](https://security.microsoft.com/threatanalytics3/3eb53378-892d-4695-a497-25d0a54181ee)\r\n[

🛡️Tool Profile: StealC

](https://security.microsoft.com/threatanalytics3/4d837c12-1db4-49c8-8466-219198d40b9b)\r\n[

🛡️OSINT Profile: UNC1151/Ghostwriter phishing campaign targeting Gmail accounts

](https://security.microsoft.com/threatanalytics3/b1a7e5e7-4b43-4758-8805-f714a131161a)\r\n[

🛡️Activity Profile: Encrypted message campaign targets real estate/financial sectors

](https://security.microsoft.com/threatanalytics3/651d669a-4721-42ab-bb96-509e94b5bfd9)\r\n\r\n
\r\n\r\nView all\r\n \r\n\r\n" }, "name": "text - 10", "styleSettings": { "margin": "0", "padding": "0" }, "id": "0c781e85-af9a-41a6-9cf7-b3bb9a09d5d0" } ] }, "customWidth": "100", "name": "group - Exec Emerging Threats", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "4f8886d3-882a-4c14-ab7f-a37bd302e32f" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Microsoft 365 Secure Email Gateway Performance\r\n
\r\n\r\n

Using multiple vendor email security products can offer diverse detections. However, our comprehensive end-to-end approach—spanning prevention, detection, posture, investigation, response, and user training—delivers a unified and effective defense that matches or exceeds the efficacy of siloed Secure Email Gateway solutions.

\r\n\r\n[

Learn more

](https://www.microsoft.com/en-us/security/blog/2026/06/15/microsoft-defender-email-security-benchmarking-key-insights-from-one-year-of-data/) \r\n\r\n
\r\n

High-severity email threats missed per 1,000 users protected - February–April 2026 (Microsoft Defender email security benchmarking)

" }, "name": "text - 12", "id": "94c804f9-2860-4768-be59-fb31a4ff22d7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "datatable(Index:int, Name:string, Value:int)\r\n[\r\n 1, \"Defender for Office 365\", 194,\r\n 2, \"Mimecast\", 478,\r\n 3, \"ProofPoint\", 483,\r\n 4, \"HornetSecurity\", 813,\r\n 5, \"TrendMicro\", 1151,\r\n 6, \"IronPort\", 1274,\r\n 7, \"Barracuda\", 1585,\r\n 8, \"FireEye\", 2107\r\n]\r\n| project [\"Email security solution\"] = Name, [\"High-severity threats missed / 1K users\"] = Value\r\n| order by [\"High-severity threats missed / 1K users\"] asc\r\n", "size": 0, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Email security solution", "formatter": 1, "formatOptions": { "customColumnWidthSetting": "40%" } }, { "columnMatch": "High-severity threats missed / 1K users", "formatter": 3, "formatOptions": { "palette": "blue", "min": 0, "max": 2107, "customColumnWidthSetting": "60%" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": true } } } ], "rowLimit": 10, "sortBy": [ { "itemKey": "High-severity threats missed / 1K users", "sortOrder": 1 } ] } }, "name": "query - 11", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "e54fd5bd-17e2-40dc-897d-8a3bb21116ff" } ] }, "customWidth": "100", "name": "group - Exec SEG Performance", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "1f3a7e2b-0a1f-48ba-9da3-e7531d500938" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "id": "ab3756d3-3f60-4024-9376-0f1a7d47ac13", "type": 1, "name": "text - 18", "content": { "json": "\r\n\r\n\r\n\r\n
Stay Current\r\n
\r\n\r\n
\r\n\r\n- **Threat Analytics (Defender XDR)** — live, tenant-specific threat intelligence and recommended actions: aka.ms/threatanalytics\r\n- **Microsoft Security Blog** — campaign write-ups and threat research: microsoft.com/security/blog\r\n- **Microsoft Defender for Office 365 Tech Community blog** — product updates and reporting guidance: Tech Community\r\n- **Latest features in Microsoft Defender for Office 365** — What's new in Microsoft Defender for Office 365 \r\n- **Share reporting feedback**: aka.ms/mdoreportingfeedback\r\n" } } ] }, "customWidth": "100", "name": "group - Exec Stay Current", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "5e22c565-cd2e-41f3-8d5a-0735af67c93f" } ], "exportParameters": true }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "1" }, "name": "Detection Overview", "styleSettings": { "margin": "0", "padding": "0" }, "id": "3f2cc277-9eb3-486d-a1f8-9fa5374a3d80" }, { "type": 1, "content": { "json": "# Malware detection insights\r\n\r\n---\r\n\r\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **malware threat** (such as viruses, spyware, or ransomware) within its **URLs** or **attachments**." }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "text - 13", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "81f28ffc-b69e-4960-a61c-cac17a012ed6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//KPI summary of inbound email malware detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet mal = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Malware\";\r\nlet inbox = mal | where DeliveryLocation has \"Inbox\";\r\nlet malTrend = toscalar(mal | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(mal | summarize count()), Details = \"Malware Emails\", Ord = 1, Trend = malTrend),\r\n(print Count = toscalar(mal | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = malTrend),\r\n(print Count = toscalar(mal | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = malTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 21, "formatOptions": { "min": 0, "palette": "blue" } }, "showBorder": true, "size": "auto" } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "malware kpi strip", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "20c06dd3-5025-4b2b-960e-ff012f5d2343" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Malware Detection Trends, Threat Classes, and Malware Names\r\n
\r\n\r\nThis section consolidates key visuals that track and explain malware detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trend, threat classes and Malware types. \r\n

**Recommended action:** If malware volume spikes, confirm Safe Attachments (Block mode) is enabled for all users and investigate the top malware families below." }, "name": "text - 14", "id": "1f09c6ec-b2de-4aa9-bd8e-81d11c92ebd4" }, { "type": 1, "content": { "json": "### Malware Detection Trend\r\n**This visual displays a per-{Granularity} trend of email malware detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for malware threats.**" }, "name": "text - Malware Trend header", "id": "e90b714f-de84-4571-9a60-b3b2f3bd09dd" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Malware detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents \r\n| where ThreatTypes has \"Malware\" \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize MalwareDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, MalwareDetections = coalesce(MalwareDetections, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "MalwareDetections", "color": "blueDark" } ] } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "query - 0", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "350d0aa3-c093-4105-a150-c20111ac2912" }, { "type": 1, "content": { "json": "### Malware Detection Trend - Advanced Threats\r\n**Not all threats are going to be easily recognisable, that's why Microsoft Defender for Office 365 has advanced threat detection methods, that use virtual sandbox environments to detonate URLs and Files. These virtual sandbox technologies look for known patterns, such as a recognisable login page in a URL, or a file accessing command and control infrastructure. This visual displays a per-{Granularity} trend of Malware detections of these advanced threats**" }, "name": "text - Malware Advanced Threats header", "id": "12e07248-ada4-41d9-99cc-824eb65cff79" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| where MalwareMethod in ('File detonation','URL detonation')\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "File detonation", "color": "redDark" }, { "seriesName": "URL detonation", "color": "orangeDark" } ] } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "query - 9", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "ebcb6f29-02be-4dd0-b792-cd99285c29d4" }, { "type": 1, "content": { "json": "### Malware Detections by Threat Classification\r\n**Summary of email messages detected by Microsoft Defender for Office 365 as malware, grouped by type of malware (Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware).**" }, "customWidth": "33", "name": "text - 15", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "5638fc51-0830-4675-87d4-82f03df17bbf" }, { "type": 1, "content": { "json": "### Top Attacked Users by Malware Threat Classification\r\n**Displays the recipient most frequently targeted for each malware type (Adware, Downloader, HackTool, Ransomware, Remote access trojan, Spyware) in inbound email detections.**" }, "customWidth": "33", "name": "text - 15 - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "d2e3903b-4984-40da-a437-3d6a2b121e23" }, { "type": 1, "content": { "json": "### Malware Detections by Threat Name\r\n**Summarises email messages flagged by Microsoft Defender for Office 365, grouped by specific malware names detected in URLs or attachments.**" }, "customWidth": "33", "name": "text - 15 - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "6c0bebcf-9838-4385-ab3a-30db6c994284" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Malware detections summarizing the data by threat classification of the malware threat in the message.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has 'Malware' and ThreatClassification has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count(Key) by ThreatClassification\r\n| sort by Count desc", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "query - 11", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "acb98530-8e3a-4383-b42f-8fd74b1c3fbe" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises Malware detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Malware\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\r\n| summarize Count = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\r\n| sort by Count desc\r\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Count", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "TopEmailCount", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ], "filter": true }, "statSettings": { "valueField": "RecipientEmailAddress", "valueAggregation": "None", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed", "thresholdsGrid": [] }, "iconSettings": { "thresholdsGrid": [] }, "tagText": "", "valueFontStyle": "auto" }, "chartSettings": { "xAxis": "RecipientEmailAddress" } }, "customWidth": "33", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "query - 5 - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "d9b46c97-91ce-4d64-aca6-3126ac49c0ff" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected.\r\nEmailEvents \r\n| where isnotempty(ThreatNames) and ThreatTypes has \"Malware\" \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| mv-expand ThreatName = split(ThreatNames, \",\") to typeof(string)\r\n| where isnotempty(ThreatName)\r\n| distinct Key, ThreatName\r\n| summarize Count = count() by ThreatName\r\n| top 15 by Count\r\n| project ['Threat Name'] = ThreatName, Count", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "chartSettings": { "xAxis": "ThreatNames", "yAxis": [ "count_" ], "createOtherGroup": 10 } }, "customWidth": "33", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "query - 3", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "b9a4b34f-f54f-4d6e-bb20-81925d0f5540" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "group - 3", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "82853a93-e11f-4e4a-80f4-733850a1d3ff" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Malware Detections by Delivery Location, Detection Technology and Sender Infrastructure Insights\r\n
\r\n\r\nThis section consolidates key visuals that track and explain malware detections delivery locations, detection technologies used for detections, sender infrastructure insights in inbound email identified by Microsoft Defender for Office 365 as Malware. \r\n

**Recommended action:** For sender IPs or countries you do not do business with, consider connection filtering or geo-based rules; verify the detection technologies catching these are enabled." }, "name": "banner - Malware Delivery Detection Sender", "id": "cba6403d-e2b1-4fe8-af52-57e5c2aa8e54" }, { "type": 1, "content": { "json": "### Malware Detections by delivery location\r\n**Visualizes counts (per {Granularity}) of malware detections of inbound emails by delivery location: Quarantine or Failed (rejected with or without NDR)**" }, "name": "text - Malware Delivery Location header", "id": "95be7f48-40eb-4154-91d8-20f7033f2ff5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware' and EmailDirection == 'Inbound'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalMalwareDetections=count(), Quarantine=countif(DeliveryLocation == 'Quarantine'), Failed=countif(DeliveryLocation == 'Failed') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalMalwareDetections=coalesce(TotalMalwareDetections,0), Quarantine=coalesce(Quarantine,0), Failed=coalesce(Failed,0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "TotalMalwareDetections", "color": "blue" }, { "seriesName": "Quarantine", "color": "orangeDark" }, { "seriesName": "Failed", "color": "redDark" } ] } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "query - 10", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "b2c19e58-2123-490b-9631-c0b238c582e6" }, { "type": 1, "content": { "json": "### Malware Detections by Detection Technology\r\n**Visualizes counts (per {Granularity}) of Malware detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**" }, "name": "text - Malware Detection Technology header", "id": "f3c2691e-4f32-4109-9524-8a11719e4425" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "customWidth": "66", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "query - 8", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "f00c1ce0-e55e-44c0-8bf0-4af662ccef89" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls in Microsoft Defender for Office 365.\r\nEmailEvents \r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod)\r\n| sort by Count desc\r\n| project ['Detection Technology'] = MalwareMethod, ['Detections'] = Count", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Detections", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ], "filter": true } }, "customWidth": "34", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "query - 2", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "590880a9-1cf7-44ae-b4de-2f65bc700b5d" }, { "type": 1, "content": { "json": "### Malware Detections by SenderIPv4 Geo Location\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Malware, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**" }, "name": "text - Malware Geo Location header", "id": "19d78b48-af58-4bee-abfe-57efb1eba125" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Malware detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_", "size": 0, "showAnalytics": true, "title": "Malware Detections-Sender Heatmap (IPv4)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "map", "gridSettings": { "sortBy": [ { "itemKey": "count_", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "count_", "sortOrder": 2 } ], "mapSettings": { "locInfo": "LatLong", "locInfoColumn": "GeoInfo", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "SenderIPv4", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "none" } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "query - 1", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "8cb46ec0-ac2a-41d1-bf8a-0b8585d1fefc" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Malware detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Malware Emails'] = count_\r\n| sort by ['Malware Emails'] desc\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Malware Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "sortBy": [], "mapSettings": { "locInfo": "LatLong", "locInfoColumn": "GeoInfo", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "SenderIPv4", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "red" } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "query - 1 - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "b6a0355a-2b8f-48a5-8edc-58f4f7f8180a" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "Malware-Detectiontech-Deliverylocation-SendingInfra", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "2692cb5e-825c-45c1-bd3a-096b55e8d760" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Malware Detections Top attacked users and top senders\r\n
\r\n\r\nThis section consolidates key visuals that track and explain malware detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders. \r\n

**Recommended action:** Apply the Strict preset security policy to the most-attacked users and consider adding persistent malicious sender domains to the Tenant Allow/Block List." }, "name": "banner - Malware Top Users Senders", "id": "bc5b37a4-71e4-4a2f-b0ba-b3dd87333391" }, { "type": 1, "content": { "json": "### Malware Detections top attacked users\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Malware. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**" }, "customWidth": "100", "name": "text - Malware Top Users header", "id": "cb87a026-ad03-45cc-887e-ab460490d9a5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total inbound emails with Malware detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(ThreatTypes has \"Malware\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| where MalwareEmailCount !=0\r\n| top 15 by MalwareEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Malware Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Inbound", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad Traffic %", "formatter": 4, "formatOptions": { "palette": "red", "min": 0, "max": 20, "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "sortBy": [] }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "query - Malware Top Recipients", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "e7ffef62-f85e-4188-8ab9-d90a5c666c30" }, { "type": 1, "content": { "json": "### Top 10 Sender Domains with Malware Detections (Inbound)\r\n**Displays the top 10 sender domains sending inbound emails detected as Malware. Helps identify external sources most frequently associated with malicious content for prioritised threat monitoring and mitigation.**" }, "customWidth": "100", "name": "text - Malware Top Senders header", "id": "93390807-25b2-4bea-9648-98e821da8ec6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Malware detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount = count(), MalwareEmailCount = countif(ThreatTypes has \"Malware\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| where MalwareEmailCount !=0\r\n| top 15 by MalwareEmailCount\r\n| project ['Sender Domain'] = SenderFromDomain, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Malware Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Inbound", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad Traffic %", "formatter": 4, "formatOptions": { "palette": "red", "min": 0, "max": 20, "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "BadEmailCount", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "sortBy": [] }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "query - Malware Top Sender Domains", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "eaa45734-2df2-4a5e-b35b-1295e00cb46f" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "2" }, "name": "MalwareTopAttackedUser-TopSenders", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "4e0900ab-e7e4-4cf1-93a4-7e86bca20782" }, { "type": 1, "content": { "json": "# Phishing Detection Insights\r\n\r\n---\r\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **Phishing threat** within its **email content**, **URLs**, or **attachments**." }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "3" }, "name": "text - 24", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "fe82d665-fa9e-4fc2-9ba9-7e2eabb9a04b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//KPI summary of inbound email phishing detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet ph = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Phish\";\r\nlet inbox = ph | where DeliveryLocation has \"Inbox\";\r\nlet phTrend = toscalar(ph | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(ph | summarize count()), Details = \"Phish Emails\", Ord = 1, Trend = phTrend),\r\n(print Count = toscalar(ph | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = phTrend),\r\n(print Count = toscalar(ph | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = phTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 21, "formatOptions": { "min": 0, "palette": "blue" } }, "showBorder": true, "size": "auto" } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "3" }, "name": "phish kpi strip", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "5debf0b8-4384-485b-8a7f-71ead592718a" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Phishing Detection Trend, LLM Content Analysis, Advanced Threats, and Threat Classes\r\n
\r\n\r\nThis section consolidates key visuals that track and explain Phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trends, advanced threat detections, LLM-based content analysis, and threat classes.

**Recommended action:** Review the LLM-classified phishing themes; enable Safe Links and impersonation protection, and prioritise awareness training on the dominant lure types." }, "name": "text - Phish Section1 Banner", "id": "ce5e489f-c83b-4bc8-9e63-b08dfb5ef31f" }, { "type": 1, "content": { "json": "### Phish Detection Trend
\r\n\r\n**This visual displays a per-{Granularity} trend of email Phish detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for Phish threats.**" }, "name": "text - Phish Trend Header", "id": "429ef4d2-61a9-40d0-940f-2212ddce22ce" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish detections over time summarizing the data daily.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\"\r\n| summarize PhishDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, PhishDetections = coalesce(PhishDetections, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "PhishDetections", "color": "blueDark" } ] } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "3" }, "name": "query - Phish Trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "b0d170ec-331c-4ad0-8ce6-258704cc5345" }, { "type": 1, "content": { "json": "### Phish Detection Trend - Advanced Threats
\r\n\r\n**Not all threats are easily recognizable, which is why Microsoft Defender for Office 365 uses advanced detection methods, including virtual sandbox environments to detonate URLs and files. These virtual sandbox technologies look for known patterns, such as a recognisable login page in a URL, or a file accessing command and control infrastructure. This visual displays a per-{Granularity} trend of Phish detections of these advanced threats.**" }, "name": "text - Phish AdvThreats Header", "id": "425476e0-066a-42ee-afb9-5dabc612a3c8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| project Timestamp, RecipientEmailAddress, NetworkMessageId, DT=parse_json(DetectionMethods)\r\n| evaluate bag_unpack(DT)\r\n| summarize [\"File detonation\"]=countif(Phish has 'File detonation' and Phish !has 'File detonation reputation'), [\"URL detonation\"]=countif(Phish has 'URL detonation' and Phish !has 'URL detonation reputation') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"File detonation\"]=coalesce([\"File detonation\"],0), [\"URL detonation\"]=coalesce([\"URL detonation\"],0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "URL detonation", "color": "orangeDark" }, { "seriesName": "File detonation", "color": "redDark" } ] } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "3" }, "name": "query - Phish AdvThreats Trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "6b62347a-b162-49e6-891c-07697af22dd9" }, { "type": 1, "content": { "json": "### Phish Detections - LLM content analysis
\r\n\r\n**Microsoft Defender for Office 365 uses Language AI for Phish and Business Email Compromise (BEC) detection. These models are progressively learning from thousands of real-world phishing attempts and analyzing all messages classified as phish. Furthermore, it incorporates advanced Machine Learning and Natural Language Processing (NLP) techniques to read, process, and understand email content the way a human analyst might, yet in a fraction of the time and at a large scale. [Learn more](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/microsoft-defender-for-office-365s-language-ai-for-phish-enhancing-email-securit/4410446)**" }, "customWidth": "50", "name": "text - Phish LLM Content Header", "id": "c23460b1-e025-4f6c-b2d5-3f78c0c9afc6" }, { "type": 1, "content": { "json": "### Phish Detections - LLM Threat Classifications
\r\n\r\n**Microsoft Defender for Office 365 uses purpose-built Large Language Models (LLM) at scale to provide AI-powered email and collaboration security. Our solution now parses language to understand and identify attacker intent and classifies threats at machine speed – keeping malicious emails out of your inbox and giving security operations (SOC) teams a new level of insight into adversary techniques. [Learn more](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/microsoft-ignite-redefining-email-security-with-llms-to-tackle-a-new-era-of-soci/4302421)**" }, "customWidth": "50", "name": "text - Phish LLM ThreatClass Header", "id": "1d723c26-501f-4385-9331-957ab7ae5019" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of emails detected as Phish by LLM content analysis detection technology in Microsoft Defender for Office 365. \r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has 'Phish' and DetectionMethods contains \"LLM content analysis\"\r\n| summarize count()\r\n| sort by count_ desc", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "stat", "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "thresholds", "mode": "foreground", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "0", "representation": "red" }, { "operator": "<=", "thresholdValue": "0", "representation": "red" } ] }, "iconSettings": { "thresholdsGrid": [] }, "tagText": "", "valueFontStyle": "auto", "tagTextPosition": "bottom" } }, "customWidth": "50", "name": "query - Phish LLM Content Count", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "86a301c5-2bc0-436a-982c-861beee7c9ab" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish detections summarizing the data by intent of the message.\r\n// Microsoft Defender for Office 365 LLM analysis is analyzing email messages to understand the intent of the messages. These threat classifications are then used in filtering decisions.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has 'Phish' and ThreatClassification has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\r\n| summarize count() by ThreatClassification\r\n| sort by count_ desc", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "chartSettings": { "yAxis": [ "count_" ], "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - Phish LLM ThreatClass Pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "d547b730-f174-4f78-8998-02f24453304e" }, { "type": 1, "content": { "json": "### Top Attacked Users by LLM Threat classes (Phish)
\r\n\r\n**Displays recipients most frequently targeted by inbound phishing emails, grouped by threat classification (e.g., Gift Card, Invoice, Payroll). Helps identify users at higher risk for phishing attacks. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**" }, "customWidth": "100", "name": "text - Phish LLM TopUsers Header", "id": "4ba9d9eb-d88d-4e5d-ba58-a740559677f7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises Phish detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\r\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\r\n| summarize Emails = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\r\n| sort by Emails desc\r\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Emails", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "80px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] } }, "customWidth": "100", "name": "query - Phish LLM TopUsers", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "51599ab2-db69-4195-b4e9-2828729ec35b" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "3" }, "name": "group - 5", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "25c47f6a-3525-435e-90cf-357f02fb2fed" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Phish Detections by Delivery location, Detection technology and Sender infrastructure insights\r\n
\r\n\r\nThis section consolidates key visuals that track and explain Phish detections delivery locations, detection technologies used for detections, sender infrastructure insights in inbound email identified by Microsoft Defender for Office 365 as Phish.

**Recommended action:** Verify anti-phishing and Safe Links policies cover these delivery paths; consider blocking sender infrastructure from regions you do not operate in, where appropriate." }, "name": "text - Phish Section2 Banner", "id": "6876063e-6a4f-48ea-829d-4486922783dd" }, { "type": 1, "content": { "json": "### Phish Detections by delivery location
\r\n\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various delivery locations: Quarantine, Junk folder or Failed (rejected with or without NDR)**" }, "name": "text - Phish DeliveryLoc Header", "id": "b5045aab-1b4b-4d35-af41-a6315d36e864" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.\r\n//The comment in the query excludes deliveries to the SecOps Mailboxes and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\" and EmailDirection == \"Inbound\"\r\n| summarize TotalPhishDetections=count(), Quarantine=countif(DeliveryLocation == \"Quarantine\"), Junkfolder=countif(DeliveryLocation == \"Junk folder\"), Inbox=countif(DeliveryLocation == \"Inbox/folder\"), Failed=countif(DeliveryLocation == \"Failed\"), Dropped=countif(DeliveryLocation == \"Dropped\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalPhishDetections=coalesce(TotalPhishDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Quarantine", "color": "greenDark" }, { "seriesName": "Failed", "color": "green" }, { "seriesName": "Dropped", "color": "green" }, { "seriesName": "Junk folder", "color": "orangeDark" }, { "seriesName": "Inbox", "color": "redBright" } ] } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "3" }, "name": "query - Phish DeliveryLoc Trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "e839848c-d176-4251-bbb4-1c2e1103ed2d" }, { "type": 1, "content": { "json": "### Phish detections by Detection Technology
\r\n\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**" }, "name": "text - Phish DetTech Header", "id": "149bf1b3-80cc-4e82-ae5d-ddee0f6b0cd9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls in Microsoft Defender for Office 365.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "createOtherGroup": 15 } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "3" }, "name": "query - Phish DetTech Trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "b0b16329-e1a6-4138-871e-76d57a60b978" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish detections summarized by individual Phish detection technology/control in Microsoft Defender for Office 365.\r\n//Each detection technology is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\n//The where clause excludes deliveries to the SecOps Mailbox and by the Phish Simulation system.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Detections", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ], "filter": true } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "3" }, "name": "query - Phish DetTech Pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "5270ba04-599f-4940-805b-687f7475bc70" }, { "type": 1, "content": { "json": "### Phish Detections by SenderIPv4 Geo Location
\r\n\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**" }, "name": "text - Phish Geo Header", "id": "ddd0c12f-1bb1-4d7d-afb4-f28bcfcd7c4b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address (SenderIPv4).\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\" and isnotempty(SenderIPv4)\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "map", "mapSettings": { "locInfo": "LatLong", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "SenderIPv4", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "none" } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "3" }, "name": "query - Phish Geo Map", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "85ea7223-7d77-43f5-b0d9-e0de7c898758" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Phish' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Phish Emails'] = count_\r\n| sort by ['Phish Emails'] desc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Phish Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ] }, "mapSettings": { "locInfo": "LatLong", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "SenderIPv4", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "red" } } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "3" }, "name": "query - Phish Country Table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "f561209b-15a6-442e-af10-63e375088209" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "3" }, "name": "group - 25- Phish delivery locations-detecion tech-sender infra", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "10f3e3eb-b330-4955-952e-01eff69405e9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Phish Detections Top attacked users and top senders\r\n
\r\n\r\nThis section consolidates key visuals that track and explain phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders.

**Recommended action:** Enroll the most-targeted users in security awareness training and consider blocking persistent phishing sender domains." }, "name": "text - Phish Section3 Banner", "id": "f46ed4a8-e2b5-4ccd-ae38-efc571bfc791" }, { "type": 1, "content": { "json": "### Phish Detections top attacked users\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Phish. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**" }, "customWidth": "100", "name": "text - Phish TopUsers Header", "id": "96d9b543-070a-42d4-bbed-3f5cf79ca7ce" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total inbound emails with Phish detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),PhishEmailCount = countif(ThreatTypes has \"Phish\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where PhishEmailCount !=0\r\n| top 15 by PhishEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Phish Emails'] = PhishEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Phish Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Inbound", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad Traffic %", "formatter": 4, "formatOptions": { "palette": "red", "min": 0, "max": 20, "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "redDark" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "sortBy": [] }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "3" }, "name": "query - Phish TopRecipients Table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "25100115-78d3-4144-b44e-613b44f02484" }, { "type": 1, "content": { "json": "### Top 10 Sender Domains with Phish Detections (Inbound)\r\n**Displays the top 10 sender domains sending inbound emails detected as Phish. Helps identify external sources most frequently associated with malicious content for prioritised threat monitoring and mitigation.**" }, "customWidth": "100", "name": "text - Phish TopSenders Header", "id": "e7fcb7fe-4bca-4153-a9b0-8ded135b1c64" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain), now including the Phish confidence split (High/Normal) and the aggregated phish detection methods seen per domain. Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection == \"Inbound\"\r\n| extend PhishConf = tostring(parse_json(ConfidenceLevel).Phish)\r\n| extend PhishMethods = parse_json(DetectionMethods).Phish\r\n| summarize TotalEmailCount = count(),\r\n PhishEmailCount = countif(ThreatTypes has \"Phish\"),\r\n Phish_High = countif(ThreatTypes has \"Phish\" and PhishConf == \"High\"),\r\n Phish_Normal = countif(ThreatTypes has \"Phish\" and PhishConf == \"Normal\"),\r\n PhishMethodSet = make_set_if(PhishMethods, ThreatTypes has \"Phish\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where PhishEmailCount != 0\r\n| top 15 by PhishEmailCount\r\n| mv-apply S = PhishMethodSet on ( mv-expand m = S to typeof(string) | summarize Methods = make_set(m) )\r\n| project ['Sender Domain'] = SenderFromDomain, ['Phish Emails'] = PhishEmailCount, ['Phish (High)'] = Phish_High, ['Phish (Normal)'] = Phish_Normal, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound, ['Detection Methods'] = strcat_array(Methods, \", \")", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Phish Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Phish (High)", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Phish (Normal)", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Inbound", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad Traffic %", "formatter": 4, "formatOptions": { "palette": "red", "min": 0, "max": 20, "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "BadEmailCount", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "redDark" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "sortBy": [] }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "3" }, "name": "query - Phish TopSenders Table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "717bfce8-b5d4-4900-99db-4ba0c503591d" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "3" }, "name": "group - 26-PhishDetectionsTopattackedusers-topsenders", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "553afca2-caa1-45b1-bec0-dca426b5be46" }, { "type": 1, "content": { "json": "# Spam Detection Insights\r\n\r\n---\r\nThis tab provides insights into email message **detections** by Microsoft Defender for Office 365 where the message contained a **Spam threat** within its **email content**, **URLs**, or **attachments**." }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "4" }, "name": "text - Spam Tab Intro", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "a693a05a-a772-4ac4-9863-07ad0d1b7092" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//KPI summary of inbound email spam detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet sp = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Spam\";\r\nlet junk = sp | where DeliveryLocation has \"Junk\";\r\nlet spTrend = toscalar(sp | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet junkTrend = toscalar(junk | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(sp | summarize count()), Details = \"Spam Emails\", Ord = 1, Trend = spTrend),\r\n(print Count = toscalar(sp | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = spTrend),\r\n(print Count = toscalar(sp | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = spTrend),\r\n(print Count = toscalar(junk | summarize count()), Details = \"Sent to Junk\", Ord = 4, Trend = junkTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 21, "formatOptions": { "min": 0, "palette": "blue" } }, "showBorder": true, "size": "auto" } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "4" }, "name": "spam kpi strip", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "cadd5331-1db8-4ac8-bc99-42cd5227ee51" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Spam Detection Effectiveness and Trends\r\n
\r\n\r\nThis section consolidates key visuals that track and explain Spam detections in inbound email as identified by Microsoft Defender for Office 365 focusing on Effectiveness and per-{Granularity} trend. For effectiveness, we consider messages reported by your admins and decisions made post-delivery.

**Recommended action:** If legitimate mail is marked as spam, review the Spam and Bulk thresholds; if spam is leaking through, tighten them." }, "name": "text - Spam Section1 Banner", "id": "1093f3b6-cea7-4f54-9029-f9aadd79ca9f" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query calculates the effectiveness of spam detections without edge data.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n// baseQuery _FN_Admin_Submissions_SPM\r\nlet _FN_Admin_Submissions_SPM = toscalar(\r\nCloudAppEvents\r\n| where Timestamp between (minTime .. maxTime)\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\r\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\r\n| where SubmissionType in (\"0\")\r\n| summarize count()\r\n);\r\n// baseQuery _FN_ZAP_Successful_Spam\r\nlet _FN_ZAP_Successful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult == \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\r\n);\r\n// baseQuery _FN_ZAP_Unsuccessful_Spam\r\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult != \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\r\n);\r\n// baseQuery _SPAM_ZAP_FP\r\nlet _SPAM_ZAP_FP = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and Action has_any (\"Redelivery\",\"Reprocessed\") and Timestamp between (minTime .. maxTime)\r\n| join kind=leftsemi (\r\n EmailEvents\r\n | where Timestamp between (minTime ..maxTime )\r\n | where ThreatTypes contains \"Spam\"\r\n | project NetworkMessageId, ThreatTypes)\r\n on NetworkMessageId\r\n| summarize count()\r\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\r\n);\r\n// baseQuery _Spam_Mailflow\r\nlet _Spam_Mailflow = toscalar(\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and ThreatTypes == \"Spam\" and Timestamp between (minTime .. maxTime)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count()\r\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\r\n);\r\nprint\r\nEffectiveness_PostDelivery = abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))/(toreal(toscalar(_Spam_Mailflow))+toreal(toscalar(_FN_ZAP_Successful_Spam))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))+toreal(toscalar(_FN_Admin_Submissions_SPM))-toreal(toscalar(_SPAM_ZAP_FP)))*100-100),2))", "size": 1, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "stat", "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "thresholds", "mode": "foreground", "heatmapPalette": "greenRed", "thresholdsGrid": [ { "operator": ">", "thresholdValue": "95", "representation": "green" }, { "operator": "<=", "thresholdValue": "95", "representation": "orange" }, { "operator": "<=", "thresholdValue": "90", "representation": "red" } ] }, "iconSettings": { "thresholdsGrid": [] }, "numberFormatSettings": { "unit": 1, "options": { "style": "decimal" } }, "tagText": "Spam Effectiveness (without Edge data)", "valueFontStyle": "superLarge", "tagTextPosition": "bottom" } }, "customWidth": "50", "name": "query - Spam Effectiveness Stat", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "036851c1-489e-4fda-8059-850c161578b3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n// baseQuery _FN_Admin_Submissions_SPM\r\nlet _FN_Admin_Submissions_SPM = toscalar(\r\nCloudAppEvents\r\n| where Timestamp between (minTime .. maxTime)\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\r\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\r\n| where SubmissionType in (\"0\")\r\n| summarize count()\r\n);\r\n// baseQuery _FN_ZAP_Successful_Spam\r\nlet _FN_ZAP_Successful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult == \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\r\n);\r\n// baseQuery _FN_ZAP_Unsuccessful_Spam\r\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult != \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\r\n);\r\n// baseQuery _SPAM_ZAP_FP\r\nlet _SPAM_ZAP_FP = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and Action has_any (\"Redelivery\",\"Reprocessed\") and Timestamp between (minTime .. maxTime)\r\n| join kind=leftsemi (\r\n EmailEvents\r\n | where Timestamp between (minTime ..maxTime )\r\n | where ThreatTypes contains \"Spam\"\r\n | project NetworkMessageId, ThreatTypes)\r\n on NetworkMessageId\r\n| summarize count()\r\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\r\n);\r\n// baseQuery _Spam_Mailflow\r\nlet _Spam_Mailflow = toscalar(\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and ThreatTypes == \"Spam\" and Timestamp between (minTime .. maxTime)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count()\r\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\r\n);\r\nprint StatisticName=\"Spam Mailflow Minus FPs\", Value=toreal((toscalar(_Spam_Mailflow)) - toreal(toscalar(_SPAM_ZAP_FP)))\r\n| union (print StatisticName=\"Spam Admin FNs Submitted\", Value=toreal(toscalar(_FN_Admin_Submissions_SPM)))\r\n| union (print StatisticName=\"Spam FPs Reverse Zapped\", Value=toreal(toscalar(_SPAM_ZAP_FP)))\r\n| union (print StatisticName=\"Spam Zapped Successfully\", Value=toreal(toscalar(_FN_ZAP_Successful_Spam)))\r\n| union (print StatisticName=\"Spam NotZapped\", Value=toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))\r\n| union (print StatisticName=\"Spam Effectiveness Post Delivery %\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2)))\r\n| union (print StatisticName=\"Spam Effectiveness Pre-Delivery %\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + (toscalar(_FN_ZAP_Successful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2 )))\r\n| project ['Statistic'] = StatisticName, Value", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "StatisticName", "formatter": 1 }, "leftContent": { "columnMatch": "Value", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "gridSettings": { "formatters": [ { "columnMatch": "Value", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2 } } } ] } }, "customWidth": "50", "name": "query - Spam Effectiveness Table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "8d456ea2-f04a-4d71-95c6-fbaad8c2d2f2" } ] }, "customWidth": "100", "name": "Spam Effectiveness", "id": "82812b88-e7f7-4be0-9d13-8e7a7d8c0c4e" }, { "type": 1, "content": { "json": "### Spam Detection Trend
\r\n\r\n**This visual displays a per-{Granularity} trend of email Spam detections identified by Microsoft Defender for Office 365. The area chart summarises the number of messages flagged for Spam threats.**" }, "name": "text - Spam Trend Header", "id": "b5574a88-430b-4cca-a76e-9a0b07e9da2e" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Spam detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Spam\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, SpamDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "SpamDetections", "color": "blueDark" } ] } }, "customWidth": "100", "name": "query - Spam Trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "09b7d330-1683-45c4-ac0e-8141580d13b5" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "4" }, "name": "group - 6-Spam-detections-trend", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "25273f47-8201-4565-8815-1d059ee8abb6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Spam Detections by Delivery location, Detection technology, Sender infrastructure and Bulk insights\r\n
\r\n\r\nThis section consolidates key visuals that track and explain Spam detections delivery locations, detection technologies used for detections, sender infrastructure and Bulk insights in inbound email identified by Microsoft Defender for Office 365 as Spam.

**Recommended action:** Raise the Bulk Complaint Level (BCL) threshold for noisy sender domains and consider blocking high-volume, low-value bulk senders where appropriate." }, "name": "text - Spam Section2 Banner", "id": "b82f442b-a3a0-44f7-82df-2fd4a9594992" }, { "type": 1, "content": { "json": "### Spam Detections by delivery location
\r\n\r\n**Visualizes counts (per {Granularity}) of Spam detections of inbound emails by various delivery locations Quarantine, Junk folder or Failed (rejected with or without NDR)**" }, "name": "text - Spam DeliveryLoc Header", "id": "a6326d97-56cc-45fb-8019-e0c3346968f2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spam\" and EmailDirection == \"Inbound\"\r\n| summarize TotalSpamDetections=count(), Quarantine=countif(DeliveryLocation == \"Quarantine\"), Junkfolder=countif(DeliveryLocation == \"Junk folder\"), Inbox=countif(DeliveryLocation == \"Inbox/folder\"), Failed=countif(DeliveryLocation == \"Failed\"), Dropped=countif(DeliveryLocation == \"Dropped\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalSpamDetections=coalesce(TotalSpamDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "TotalSpamDetections", "color": "blue" }, { "seriesName": "Quarantine", "color": "greenDark" }, { "seriesName": "Junkfolder", "color": "orangeDark" }, { "seriesName": "Inbox", "color": "redBright" }, { "seriesName": "Failed", "color": "red" }, { "seriesName": "Dropped", "color": "redDark" } ] } }, "customWidth": "100", "name": "query - Spam DeliveryLoc Trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "97f89032-34e3-40ff-bb88-42d195aea095" }, { "type": 1, "content": { "json": "### Spam Detections Detection Technology
\r\n\r\n**Visualizes counts (per {Granularity}) of Spam detections of inbound emails by various Microsoft Defender for Office 365 detection technologies.**" }, "name": "text - Spam DetTech Header", "id": "935ea90d-8430-49d5-b942-3a7b319a603e" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Spam detections over time summarizing the data daily by various Spam Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where DetectionMethods has \"Spam\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "customWidth": "100", "name": "query - Spam DetTech Trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "f31ec0d1-04e1-4b2b-9b98-27289ca34b84" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Spam detections summarized by individual Spam detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Spam (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spam\"\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Detections", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ], "filter": true } }, "customWidth": "100", "name": "query - Spam DetTech Pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "95e40479-f0bc-41ff-8191-634b606d3632" }, { "type": 1, "content": { "json": "### Spam Detections by SenderIPv4 Geo Location
\r\n\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Spam, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**" }, "name": "text - Spam Geo Header", "id": "614d1c3f-df6a-4659-b170-7b466c66d66f" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Spam\" and isnotempty(SenderIPv4)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_ ", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "map", "mapSettings": { "locInfo": "LatLong", "locInfoColumn": "SenderIPv4", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "SenderIPv4", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "none" } } }, "customWidth": "50", "name": "query - Spam Geo Map", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "5519d715-dc79-45f8-8ed5-a63a253c45e3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Spam detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Spam' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Spam Emails'] = count_\r\n| sort by ['Spam Emails'] desc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Spam Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ] }, "mapSettings": { "locInfo": "LatLong", "locInfoColumn": "SenderIPv4", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "SenderIPv4", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "red" } } }, "customWidth": "50", "name": "query - Spam Country Table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "5078dc24-e8be-4943-98fc-6527968e1e3d" }, { "type": 1, "content": { "json": "### Spam Detections Bulk Insights
\r\n\r\n**Displays the distribution of inbound emails across different Bulk Complaint Levels together with Top 10 domains sending Bulk email (grey mail). Helps identify patterns in bulk email complaints and assess potential spam or unwanted message trends.**" }, "name": "text - Spam Bulk Header", "id": "cd7b3cbe-a6c1-422c-ab37-4afc26002d5d" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels to understand how many messages are detected with each Bulk Complaint level.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isnotnull(BulkComplaintLevel)\r\n| summarize count() by BulkComplaintLevel\r\n| sort by BulkComplaintLevel desc\r\n| project ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "blueDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ] } }, "customWidth": "50", "name": "query - Spam Bulk By Level", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "021c022b-aa67-427d-9e1a-688af7aed5d4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels and SenderFromDomain of the email sender. It provides insights how many messages are detected with each Bulk Complaint level for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isnotnull(BulkComplaintLevel)\r\n| summarize count() by BulkComplaintLevel, SenderFromDomain\r\n| top 10 by count_ desc\r\n| project ['Sender Domain'] = SenderFromDomain, ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "50", "name": "query - Spam Bulk By Domain", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "b1835e0f-f9ad-44c3-bba4-cf9a9546d09a" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "4" }, "name": "group - 28-Spam-Delivery location-Detection technology-Sender infrastructure insights", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "307d3d03-93ae-4c8f-b68b-f833ee7d38e8" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n\r\n
Spam Detections Top attacked users and top senders\r\n
\r\n\r\nThis section consolidates key visuals that track and explain spam detections in inbound email as identified by Microsoft Defender for Office 365 focusing on top attacked users and top senders.

**Recommended action:** Review the most-affected users and the top spam sender domains as possible block-list candidates." }, "name": "text - Spam Section3 Banner", "id": "4c34ed7b-86da-4ee1-8a69-f96c213a4340" }, { "type": 1, "content": { "json": "### Spam Detections top attacked users
\r\n\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Spam. These users may be at higher risk and should be prioritised for targeted cybersecurity awareness training. Training should cover the specific threat types and techniques they are exposed to, and reinforce best practices for promptly reporting any suspicious messages that might bypass security controls and reach their inbox.**" }, "customWidth": "100", "name": "text - Spam TopUsers Header", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "be708ad5-51fd-4a54-b1bc-f912e12b4a01" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection ==\"Inbound\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),SpamEmailCount = countif(ThreatTypes has \"Spam\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount)* 100, 2))\r\n| where SpamEmailCount !=0\r\n| top 15 by SpamEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Spam Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Inbound", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad Traffic %", "formatter": 4, "formatOptions": { "customColumnWidthSetting": "40ch", "palette": "red", "min": 0, "max": 20 }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "useGrouping": false } } }, { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "sortBy": [] }, "customWidth": "100", "name": "query - Spam TopRecipients Table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "6e7b357d-6792-41c5-83fc-efae31afe2ee" }, { "type": 1, "content": { "json": "### Top 10 Sender Domains with Spam Detections (Inbound)
\r\n\r\n**Displays the top 10 sender domains sending inbound emails detected as Spam. Helps identify external sources most frequently associated with spam content for prioritised monitoring and mitigation.**" }, "customWidth": "100", "name": "text - Spam TopSenders Header", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "1d1bdb8d-9619-488b-935a-3791ad73f096" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection == \"Inbound\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount = count(),\r\n SpamEmailCount = countif(ThreatTypes has \"Spam\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpamEmailCount !=0\r\n| top 15 by SpamEmailCount\r\n| project ['Sender Domain'] = SenderFromDomain, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Spam Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Inbound", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad Traffic %", "formatter": 4, "formatOptions": { "customColumnWidthSetting": "40ch", "palette": "red", "min": 0, "max": 20 }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "redDark" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "sortBy": [] }, "customWidth": "100", "name": "query - Spam TopSenders Table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "253efada-ca89-49c5-b1e3-e42ac005b938" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "4" }, "name": "group - 29-Spam Detections Top attacked users and top senders", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "d4cc057f-c9b7-40b9-85d3-52f90767d1f5" }, { "type": 1, "content": { "json": "# Email Impersonation & BEC Insights\r\n\r\n---\r\nThis tab focuses on the highest-value email threat class: **impersonation and Business Email Compromise (BEC)**. It brings together impersonation and spoof detections, sender authentication (DMARC, DKIM, SPF, CompAuth), supply-chain and partner-compromise correlation, and first-contact / new-vendor senders - the signals that precede targeted financial and credential attacks. It is the email-side companion to the impersonation insights on the **Teams & Collaboration** tab." }, "name": "text - impersonation bec description", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "15" }, "id": "fda8ccd5-fafc-457a-a6a2-05b504be1023" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//KPI summary of inbound email impersonation and spoof (BEC) detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet bec = EmailEvents | where EmailDirection == \"Inbound\" | where DetectionMethods has \"Impersonation\" or DetectionMethods has \"Spoof\";\r\nlet inbox = bec | where DeliveryLocation has \"Inbox\";\r\nlet becTrend = toscalar(bec | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(bec | summarize count()), Details = \"Impersonation / Spoof Emails\", Ord = 1, Trend = becTrend),\r\n(print Count = toscalar(bec | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = becTrend),\r\n(print Count = toscalar(bec | summarize dcount(SenderFromDomain)), Details = \"Spoofed Sender Domains\", Ord = 3, Trend = becTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 21, "formatOptions": { "min": 0, "palette": "blue" } }, "showBorder": true, "size": "auto" } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "15" }, "name": "bec kpi strip", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "91fdd28f-31c4-4f94-b60a-12cd97d44ddf" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Phish Detections Business Email Compromise (BEC) detections\r\n
\r\n\r\nThis section consolidates key visuals that track and explain phish detections in inbound email as identified by Microsoft Defender for Office 365 focusing on Business Email Compromise (BEC) detections Impersonation and Spoof.

**Recommended action:** Enable mailbox intelligence and impersonation protection for frequently-impersonated users and domains; consider adding confirmed look-alike domains to the Tenant Block List." }, "name": "text - Phish BEC Banner", "id": "e3b2232c-8056-4913-a652-64f70e228750" }, { "type": 1, "content": { "json": "### Phish Detections - Impersonation detections Trend\r\n**Displays counts (per {Granularity}) of inbound emails flagged for Business Email Compromise (BEC) using Impersonation detection methods by Microsoft Defender for Office 365. Helps track impersonation attack patterns over time.**" }, "customWidth": "100", "name": "text - Phish BEC Imp Trend Header", "id": "e95667df-3bcd-4023-9e8f-99ed05bc4bf0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has 'Impersonation'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ImpersonationDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "ImpersonationDetections", "color": "blueDark" } ] } }, "customWidth": "100", "name": "query - Phish BEC Imp Trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "61fa166d-f300-42a6-a324-de18b3fdf4c1" }, { "type": 1, "content": { "json": "### Phish Detections - Impersonation detections by Detection Technology\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies used for detecting Impersonations.**" }, "customWidth": "100", "name": "text - Phish BEC Imp Tech Header", "id": "09e1a866-f344-4a92-a3bd-8c3c3c5d598d" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily by various Impersonation Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Impersonation\"\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "customWidth": "100", "name": "query - Phish BEC Imp Tech Trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "6cd5662f-13b4-4a9b-afe7-0a6343e3ab5c" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish - Business Email Compromise (BEC) - Impersonation detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Impersonation\"\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "graphSettings": { "type": 0 }, "gridSettings": { "formatters": [ { "columnMatch": "Detections", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ], "filter": true } }, "customWidth": "100", "name": "query - Phish BEC Imp Tech Pie", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "73499618-e842-440e-a555-cd8849093884" }, { "type": 1, "content": { "json": "### Phish Detections - Impersonation detections by SenderIPv4 Geo Location\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish - Impersonation, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**" }, "customWidth": "100", "name": "text - Phish BEC Imp Geo Header", "id": "189a1ac1-f275-4697-880b-7ffae1e5d263" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Impersonation\" and isnotempty(SenderIPv4)\r\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \r\n| summarize count()by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_ ", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "map", "mapSettings": { "locInfo": "LatLong", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "SenderIPv4", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "none" } } }, "customWidth": "50", "name": "query - Phish BEC Imp Geo Map", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "574b61ad-ec2d-4517-93c5-d0e9bd14f2e9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where DetectionMethods has \"Impersonation\" and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Impersonation Emails'] = count_\r\n| sort by ['Impersonation Emails'] desc", "size": 0, "showAnalytics": true, "title": "Impersonation Detections-Sender Heatmap (IPv4)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Impersonation Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ] }, "mapSettings": { "locInfo": "LatLong", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "SenderIPv4", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "red" } } }, "customWidth": "50", "name": "query - Phish BEC Imp Country", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "e53b7dbc-4683-4309-b879-c7be68599159" }, { "type": 1, "content": { "json": "### Phish Detections - Spoof detections Trend\r\n**Displays counts (per {Granularity}) of inbound emails flagged for Business Email Compromise (BEC) using Spoof detection methods by Microsoft Defender for Office 365. Helps track Spoofing based attack patterns over time.**" }, "customWidth": "100", "name": "text - Phish BEC Spoof Trend Header", "id": "8db0f1b0-49bf-43a2-9f9f-164eb9530629" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has 'Spoof'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, SpoofDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "SpoofDetections", "color": "blueDark" } ] } }, "customWidth": "100", "name": "query - Phish BEC Spoof Trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "9a308cd9-bf05-4287-b0d5-54636d081a82" }, { "type": 1, "content": { "json": "### Phish Detections - Spoof detections Trend by Detection Technology\r\n**Visualizes counts (per {Granularity}) of Phish detections of inbound emails by various Microsoft Defender for Office 365 detection technologies used for detecting Spoofing.**" }, "customWidth": "100", "name": "text - Phish BEC Spoof Tech Header", "id": "28c9c15d-d22f-4412-9efc-868b95082668" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily by various Spoof Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Spoof\"\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "yAxis": [ "Count" ], "seriesLabelSettings": [ { "seriesName": "[\"Spoof external domain\"]", "color": "redDark" }, { "seriesName": "[\"Spoof intra-org\"]", "color": "orangeDark" }, { "seriesName": "[\"Spoof DMARC\"]", "color": "yellowDark" } ] } }, "customWidth": "100", "name": "query - Phish BEC Spoof Tech Trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "1a1328fc-5404-4dff-99ed-3a30082a4cbe" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish - Business Email Compromise (BEC) - Spoof detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Spoof\"\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Detections", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ], "filter": true } }, "customWidth": "100", "name": "query - Phish BEC Spoof Tech Pie", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "f7df9892-85b4-49c3-8739-873b745183a3" }, { "type": 1, "content": { "json": "### Phish Detections - Spoof detections by SenderIPv4 Geo Location\r\n**Visualizes the email sending infrastructure sender IPv4 addresses associated with inbound emails detected as Phish - Spoofing, along with the IPv4 address geographic coordinates (latitude, longitude) and country information. Helps identify high-risk regions and sources for targeted threat mitigation.**" }, "customWidth": "100", "name": "text - Phish BEC Spoof Geo Header", "id": "3c83e7f0-5391-4b1a-bb5b-de0d17488efd" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spoof\" and isnotempty(SenderIPv4)\r\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \r\n| summarize count()by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_ ", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "map", "mapSettings": { "locInfo": "LatLong", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "SenderIPv4", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "none" } } }, "customWidth": "50", "name": "query - Phish BEC Spoof Geo Map", "styleSettings": { "margin": "15px", "padding": "15px" }, "id": "122d860c-ab0d-475e-b29e-2955020680c7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where DetectionMethods has \"Spoof\" and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Spoof Emails'] = count_\r\n| sort by ['Spoof Emails'] desc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Spoof Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ] }, "mapSettings": { "locInfo": "LatLong", "latitude": "Latitude", "longitude": "Longitude", "sizeSettings": "count_", "sizeAggregation": "Sum", "labelSettings": "SenderIPv4", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "red" } } }, "customWidth": "50", "name": "query - Phish BEC Spoof Country", "styleSettings": { "margin": "15px", "padding": "15px" }, "id": "9d0111bc-8d01-4a99-9009-645dc02c3bed" }, { "type": 1, "content": { "json": "### Supply-Chain & Partner Risk (Possible Partner Compromise)\r\n**Correlates the external domains your organization emails most with inbound emails from those same domains that carried threats. A trusted partner or supplier domain suddenly sending threats is a strong signal that the partner may be compromised - a common supply-chain and business email compromise (BEC) vector.**

**Recommended action:** Verify any flagged partner through a trusted channel before acting on their recent messages, alert them to a possible compromise, and consider tightening inbound policy for that domain until confirmed clean." }, "customWidth": "100", "name": "text - Phish Partner Compromise Header", "id": "2c62c576-3b05-4663-ae2e-4f961d7409c6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders) \r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Outbound\"\r\n| project RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| summarize count() by RecipientDomain\r\n| project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain\r\n| join (EmailEvents | where EmailDirection == \"Inbound\" and isempty(ThreatTypes)==false) on SenderFromDomain\r\n| summarize max(OutboundCount),count() by SenderFromDomain\r\n| project SenderFromDomain, OutboundEmails=max_OutboundCount, IncomingEmailsWithThreats=count_\r\n| extend Bad_Traffic_Percentage = todouble(round(IncomingEmailsWithThreats / todouble(OutboundEmails) * 100, 2))\r\n| top 15 by OutboundEmails\r\n| project ['Sender Domain'] = SenderFromDomain, ['Outbound Emails'] = OutboundEmails, ['Inbound w/ Threats'] = IncomingEmailsWithThreats, ['Bad Traffic %'] = Bad_Traffic_Percentage", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Outbound Emails", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Inbound w/ Threats", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "60ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad Traffic %", "formatter": 4, "numberFormat": { "unit": 1, "options": { "style": "decimal" } }, "formatOptions": { "palette": "red", "min": 0, "max": 20 } } ], "filter": true } }, "customWidth": "100", "name": "query - Phish Partner Compromise", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "1aaa047c-1108-4288-833e-61ca35b5495a" }, { "type": 1, "content": { "json": "### Top Recipients Targeted by Impersonation / BEC\r\n**Lists the recipients most frequently targeted by impersonation and Business Email Compromise (BEC) attempts, showing the number of impersonation emails, how many distinct senders were involved, the top spoofed sender domains, and how many of those messages were delivered to the inbox. Helps identify high-risk users (often executives or finance staff) who may need extra protection or awareness.**" }, "customWidth": "100", "name": "text - impersonation targets", "id": "b1e7c2a4-9f3d-4a6b-8c12-7d5e9f0a1b23" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Top recipients targeted by impersonation / BEC, with distinct senders, spoofed domains and how many landed in the inbox.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| where DetectionMethods has \"Impersonation\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize ImpersonationEmails = count(),\r\n DistinctSenders = dcount(SenderFromAddress),\r\n TopSpoofedDomains = make_set(SenderFromDomain, 5),\r\n DeliveredToInbox = countif(DeliveryLocation has \"Inbox\")\r\n by RecipientEmailAddress\r\n| top 20 by ImpersonationEmails\r\n| project ['Recipient'] = RecipientEmailAddress, ['Impersonation Emails'] = ImpersonationEmails, ['Distinct Senders'] = DistinctSenders, ['Top Spoofed Domains'] = strcat_array(TopSpoofedDomains, \", \"), ['Delivered to Inbox'] = DeliveredToInbox", "size": 0, "title": "Top Recipients Targeted by Impersonation / BEC", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "showAnalytics": true, "gridSettings": { "formatters": [ { "columnMatch": "Impersonation Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ], "filter": true } }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "15" }, "name": "newviz - impersonation targets", "id": "afe28369-af82-47ae-846d-179bd86b660e" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "15" }, "name": "group - 7 - Phish-BEC-Insights", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "b7971cd9-d086-47c7-8f66-50956b9c56c3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Phish Detections Sender Authentication details (DMARC, DKIM, SPF, CompAuth)\r\n
\r\n\r\nThis section consolidates key visuals that track and explain Sender Authentication checks details in inbound email by Microsoft Defender for Office 365 focusing on the various Sender Authentication standards: DMARC, DKIM, SPF, CompAuth.

**Recommended action:** For domains failing DMARC/DKIM/SPF, verify your own outbound authentication is published and enforced (p=reject), and treat persistent external spoofers as possible block candidates." }, "name": "text - Phish Section5 Banner", "id": "90d7a338-d943-4398-b788-bfd4f93007d4" }, { "type": 1, "content": { "json": "### Phish Detections Sender Authentication Trend (DMARC, DKIM, SPF, CompAuth)\r\n**Shows counts (per {Granularity}) of sender authentication check outcomes (DMARC, DKIM, SPF, CompAuth) performed by Microsoft Defender for Office 365 on inbound emails. Useful for monitoring authentication success and failure patterns over time to identify anomalies or potential phishing risks.**" }, "customWidth": "100", "name": "text - Phish SenderAuth Trend Header", "id": "4a0ab90e-55dd-4fa6-82c3-0edc57ce0966" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Spoof- DMARC fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend DMARCFail = (tostring(parse_json(AuthenticationDetails).DMARC) == \"fail\") \r\n| summarize DMARCFail = sum(DMARCFail) by bin (Timestamp,{Granularity})", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "DMARCFail", "color": "orangeDark" } ] } }, "customWidth": "50", "name": "query - Phish Auth DMARC Trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "79920d30-01d4-4412-b994-853e50c9d7d8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Spoof- DKIM fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend DKIMFail = (tostring(parse_json(AuthenticationDetails).DKIM) == \"fail\") \r\n| summarize DKIMFail = sum(DKIMFail) by bin (Timestamp,{Granularity})", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "DKIMFail", "color": "yellowDark" } ] } }, "customWidth": "50", "name": "query - Phish Auth DKIM Trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "bf09ffd4-eee0-42f7-a507-1cf54d9c365a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Spoof- SPF fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend SPFFail = (tostring(parse_json(AuthenticationDetails).SPF) == \"fail\") \r\n| summarize SPFFail = sum(SPFFail) by bin (Timestamp,{Granularity})", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "SPFFail", "color": "purpleDark" } ] } }, "customWidth": "50", "name": "query - Phish Auth SPF Trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "4d66fe13-9904-45cf-8783-f3ee984f3a66" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Spoof- Composite Authentication fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend CompAuthFail = (tostring(parse_json(AuthenticationDetails).CompAuth) == \"fail\") \r\n| summarize CompAuthFail = sum(CompAuthFail) by bin (Timestamp,{Granularity})", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "CompAuthFail", "color": "blueDark" } ] } }, "customWidth": "50", "name": "query - Phish Auth CompAuth Trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "0968b828-23fe-4fa2-a5ea-8ab39362457f" }, { "type": 1, "content": { "json": "### Phish Detections Top Sender Domains with DMARC Failures (Inbound)\r\n**Displays the top 10 sender domains (P1 and P2) for inbound emails where Spoof-DMARC detection triggered. Includes total inbound email volume and calculates DMARC fail traffic percentage per domain to highlight high-risk sources.**" }, "customWidth": "100", "name": "text - Phish Auth DMARC Domains Header", "id": "24d4689a-eb6d-49f5-85a8-fcadca409f7a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and DMARC fail traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n DMARCFailCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof DMARC\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend DMARCFail_Traffic_Percentage = todouble(round(DMARCFailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where DMARCFailCount !=0\r\n| top 10 by DMARCFailCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['DMARC Failures'] = DMARCFailCount, ['Total Inbound'] = TotalEmailCount, ['DMARC Fail %'] = DMARCFail_Traffic_Percentage", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "DMARCFail", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Inbound", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "DMARC Fail %", "formatter": 4, "formatOptions": { "customColumnWidthSetting": "40ch", "palette": "red", "min": 0, "max": 20 }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "query - Phish Auth DMARC Domains", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "642814ad-9d24-4be9-ae10-3578e89da05b" }, { "type": 1, "content": { "json": "### Phish Detections Top Sender Domains with Spoof External Domain Detections (Inbound)\r\n**Displays the top 10 sender domains (P1 and P2) for inbound emails flagged for Spoof External Domain detection. Includes total inbound email volume and calculates spoof traffic percentage per domain to highlight high-risk sources.**" }, "customWidth": "100", "name": "text - Phish Auth SpoofExt Domains Header", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "993fdc34-354b-412e-be39-facbde4f4f0e" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof external domain detection traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n SpoofExternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof external domain\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend SpoofExternal_Traffic_Percentage = todouble(round(SpoofExternalCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpoofExternalCount !=0\r\n| top 10 by SpoofExternalCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof External'] = SpoofExternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof External %'] = SpoofExternal_Traffic_Percentage", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Spoof External", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Inbound", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Spoof External %", "formatter": 4, "formatOptions": { "customColumnWidthSetting": "40ch", "palette": "red", "min": 0, "max": 20 }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "SpoofExternalFail", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true, "sortBy": [ { "itemKey": "Spoof External %", "sortOrder": 2 } ] } }, "customWidth": "100", "name": "query - Phish Auth SpoofExt Domains", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "69ca3799-d2d5-4896-b3a5-1eeba46f0b46" }, { "type": 1, "content": { "json": "### Phish Detections Top Sender Domains with Spoof Internal Domain Detections (Inbound)\r\n**Displays the top 10 sender domains (P1 and P2) for inbound emails flagged for Spoof Internal Domain detection. Includes total inbound email volume and calculates spoof traffic percentage per domain to highlight high-risk sources.**" }, "customWidth": "100", "name": "text - Phish Auth SpoofInt Domains Header", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "3fa33c5d-0eba-471f-b47f-0c12c1f770d6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof internal domain detection traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n SpoofInternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof intra-org\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend SpoofInternal_Traffic_Percentage = todouble(round(SpoofInternalCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpoofInternalCount !=0\r\n| top 10 by SpoofInternalCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof Internal'] = SpoofInternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof Internal %'] = SpoofInternal_Traffic_Percentage", "size": 3, "showAnalytics": true, "title": "Top 10 Spoof intra-org detections by Sender domain (P1/P2)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Spoof Internal", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Inbound", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Spoof Internal %", "formatter": 4, "formatOptions": { "customColumnWidthSetting": "40ch", "palette": "red", "min": 0, "max": 20 }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "SpoofIntraorgFail", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "query - Phish Auth SpoofInt Domains", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "ae0c65c7-68ea-4d50-b177-1effeaf1c045" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "15" }, "name": "group - 8-Phish-SenderAuth", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "8077779a-4da8-46be-8032-626bd8c36dbd" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
First-Contact & New-Vendor Senders\r\n
\r\n\r\nExternal email senders and domains seen for the first time in the selected period. New/first-contact relationships - especially ones already carrying threats - are a common precursor to phishing, business email compromise (BEC), and supply-chain attacks.

**Recommended action:** Treat brand-new domains sending threats as high-priority review; verify any that claim to be a known brand or partner before trusting their messages." }, "name": "phish fc banner", "id": "05b83435-c7ed-48a3-919e-388b2e599726" }, { "type": 1, "content": { "json": "### First-contact external senders
\r\n\r\n**External email senders ordered by when they were first seen in the period (most recent first). In tenants with longer history this highlights genuinely new senders.**" }, "customWidth": "100", "name": "phish fc senders header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "c57dffb4-dfdb-4a1e-93be-16fa9e856a0d" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists external email senders seen for the first time in the selected period (most recent first), surfacing new/first-contact senders. In tenants with longer history this highlights genuinely new relationships - a common precursor to BEC and supply-chain attacks.\r\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"fabrikam.com\"]);\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend SenderDomain = tostring(split(SenderFromAddress, \"@\")[1])\r\n| where isnotempty(SenderFromAddress)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| summarize FirstSeen=min(Timestamp), Messages=count(), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderFromAddress, SenderDomain\r\n| top 20 by FirstSeen desc\r\n| project ['Sender']=SenderFromAddress, ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, ['Threat Messages']=ThreatMessages", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "Messages", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Threat Messages", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] } }, "customWidth": "100", "name": "phish fc senders table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "d1ceb0ac-2dad-49af-b416-a3376a7b8513" }, { "type": 1, "content": { "json": "### New sender domains carrying threats
\r\n\r\n**External sender domains seen for the first time in the period that already carried threats, most-recent first. A brand-new domain sending threats to your users is a strong early-warning signal.**" }, "customWidth": "100", "name": "phish fc domains header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "bd29bbe4-cde2-499c-a1d0-e2cc51f7733d" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists external sender domains seen for the first time in the selected period that already carried threats, ranked by most-recently first seen. A brand-new domain sending threats to your users is a strong early-warning signal for phishing and BEC.\r\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"fabrikam.com\"]);\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend SenderDomain = tostring(split(SenderFromAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Messages=count(), Senders=dcount(SenderFromAddress), Recipients=dcount(RecipientEmailAddress), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderDomain\r\n| where ThreatMessages > 0\r\n| top 20 by FirstSeen desc\r\n| project ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, Senders, Recipients, ['Threat Messages']=ThreatMessages, ['Last Seen']=LastSeen", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "Messages", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Senders", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Recipients", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Threat Messages", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] } }, "customWidth": "100", "name": "phish fc domains table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "7da952d5-5ae2-4b2e-a5cf-c78b11bda4f8" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "15" }, "customWidth": "100", "name": "group - Phish First Contact", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "90e5248a-2c35-48f3-869c-c45c631c6fbf" }, { "type": 1, "content": { "json": "# URL Detections and URL Click Insights\r\n\r\n---\r\nThis tab provides insights into **URL-based detections** in email messages and details about URL clicks performed by end users on URLs identified as **malicious**." }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "5" }, "name": "text - 24 - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "2156430d-fec6-48bb-a9a8-3166182f6993" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//KPI summary of URL threat protection (Safe Links clicks and URLs seen in email) for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet clicks = UrlClickEvents;\r\nlet blocked = clicks | where ActionType in (\"ClickBlocked\",\"ClickBlockedByTenantPolicy\");\r\nlet allowed = clicks | where ActionType == \"ClickAllowed\";\r\nlet blockedTrend = toscalar(blocked | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet allowedTrend = toscalar(allowed | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet usersTrend = toscalar(clicks | make-series Trend = dcount(AccountUpn) default = 0 on Timestamp step gran | project Trend);\r\nlet urlsTrend = toscalar(EmailUrlInfo | make-series Trend = dcount(Url) default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(blocked | summarize count()), Details = \"Malicious Clicks Blocked\", Ord = 1, Trend = blockedTrend),\r\n(print Count = toscalar(allowed | summarize count()), Details = \"Clicks Allowed Through\", Ord = 2, Trend = allowedTrend),\r\n(print Count = toscalar(clicks | summarize dcount(AccountUpn)), Details = \"Users Clicking Links\", Ord = 3, Trend = usersTrend),\r\n(print Count = toscalar(EmailUrlInfo | summarize dcount(Url)), Details = \"Distinct URLs in Email\", Ord = 4, Trend = urlsTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 21, "formatOptions": { "min": 0, "palette": "blue" } }, "showBorder": true, "size": "auto" } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "5" }, "name": "url kpi strip", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "d5e2326a-a5dd-4217-bb75-0e337d75d306" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Insights on URL-Based Threat Detections\r\n
\r\n\r\nThis section consolidates key visuals that track and explain URL based threat detections in inbound email as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trends of URL-based threat detections, QR code detections, and URL scans activity by locations.

**Recommended action:** Confirm Safe Links is enabled for email and Teams; investigate QR-code and URL detection spikes for emerging campaigns." }, "name": "text - 13 - Copy", "id": "ed3468e7-1936-45fd-9168-93010a662302" }, { "type": 1, "content": { "json": "### Trend of URL-Based Malware Threat Detections
\r\n\r\n**This visual displays a per-{Granularity} trend of emails with URL based Malware threat detections identified by Microsoft Defender for Office 365. The line chart summarises the number of messages flagged for malware threats.**" }, "name": "text - 13 - Copy - Copy", "id": "77e7bbac-d752-478b-bce9-06bb1bd12bfe" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware URL threat based detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| where MalwareMethod contains \"URL\"\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "customWidth": "100", "name": "query - 8 - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "79ef5e7b-57a6-4519-9899-18fd8cae5e68" }, { "type": 1, "content": { "json": "### Trend of URL-Based Phish Threat Detections
\r\n\r\n**This visual displays a per-{Granularity} trend of emails with URL based Phish threat detections identified by Microsoft Defender for Office 365. The line chart summarises the number of messages flagged for Phish threats.**" }, "name": "text - 13 - Copy - Copy - Copy", "id": "48923812-5440-4f47-8881-273f14cbfb8e" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total emails with Phishing detections over time summarizing the data daily by various Phishing URL threat based detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Phish'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand PhishMethod = ParsedMethods.Phish\r\n| where PhishMethod contains \"URL\"\r\n| summarize Count = count() by PhishMethod = tostring(PhishMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct PhishMethod | extend d = 1) on d | project Timestamp, PhishMethod\r\n| join kind=leftouter (agg) on Timestamp, PhishMethod\r\n| project Timestamp, PhishMethod, Count = coalesce(Count, 0)\r\n| sort by PhishMethod asc, Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "customWidth": "100", "name": "query - 8 - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "b983b361-6c2e-47d5-b2c5-edd9caa6a55d" }, { "type": 1, "content": { "json": "### Trend (per {Granularity}) of QR Code-Based Threat Detections
\r\n\r\n**Displays counts (per {Granularity}) of inbound emails containing QR codes flagged for Phish, Malware, or Spam via URL-based detection methods. Helps track QR code abuse patterns over time.**" }, "customWidth": "50", "name": "text - 13 - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "3d8b75e1-6e1d-44eb-b1fc-78d3db7feb71" }, { "type": 1, "content": { "json": "### URL Scan activity by Location (per {Granularity})
\r\n\r\n**Displays counts (per {Granularity}) of URLs scanned from various locations within emails (e.g., body, attachments, QR codes). Helps identify where malicious URLs are most commonly embedded.**" }, "customWidth": "50", "name": "text - 13 - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "b275b28c-e441-4c19-9055-256d5d45c69c" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where EmailDirection == \"Inbound\" \r\n| where DetectionMethods has \"Url\"\r\n| join EmailUrlInfo on NetworkMessageId\r\n| where UrlLocation == \"QRCode\"\r\n| summarize [\"Phish QR Detection\"]=countif(parse_json(DetectionMethods).Phish has \"URL\"), [\"Malware QR Detection\"]=countif(parse_json(DetectionMethods).Malware has \"URL\"), [\"Spam QR Detection\"]=countif(parse_json(DetectionMethods).Spam has \"URL\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Phish QR Detection\"]=coalesce([\"Phish QR Detection\"],0), [\"Malware QR Detection\"]=coalesce([\"Malware QR Detection\"],0), [\"Spam QR Detection\"]=coalesce([\"Spam QR Detection\"],0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "graphSettings": { "type": 0 }, "chartSettings": { "xAxis": "Timestamp", "xSettings": { "dateFormatSettings": { "formatName": "shortDatePattern", "showUtcTime": false } } } }, "customWidth": "50", "name": "query - 6", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "6c2a7724-d3c2-42b2-b8da-7acbcd0666c6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises where URL's have been scanned identified from various locations in emails\r\nEmailUrlInfo\r\n| summarize count() by UrlLocation", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "query - 5", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "5640dbd5-4085-4f2a-8fb9-e4112233e99e" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "5" }, "name": "group - 9-URL detections", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "b572d79b-17a0-48ac-9a43-4f20324cf998" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Insights on URL Click-Based Threat Detections\r\n
\r\n\r\nThis section consolidates key visuals that track and explain URL click based threat detections in emails as identified by Microsoft Defender for Office 365 focusing on per-{Granularity} trend of blocked URL clicks, time-of-click URL scans by workload, malicious clicks allowed, top clicks on malicious URLs, and more.

**Recommended action:** For blocked-click spikes, verify Safe Links is set to not allow click-through; investigate workloads with high click-through activity." }, "name": "text - 13 - Copy - Copy", "id": "6d37617e-911e-4ce6-a10d-4749486738ea" }, { "type": 1, "content": { "json": "### Trend (per {Granularity}) of Blocked URL Click Events
\r\n\r\n**Shows the count (per {Granularity}) of blocked URL click attempts and click attempts on URLs with detections, grouped by threat types (e.g., Phish, Malware, Spam). Helps track user interaction with malicious links over time across various threat types.**" }, "name": "text - 13 - Copy - Copy - Copy", "id": "9e477950-bedc-4cc0-9863-df07d124806c" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Generates a time-series analysis for blocked URL click events from the 'UrlClickEvents' table\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where isnotempty(ActionType)\r\n| where ActionType has_any(\"ClickBlocked\")\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, BlockedClicks = coalesce(Count, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "BlockedClicks", "color": "blueDark" } ] } }, "customWidth": "66", "name": "query - 4", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "366e80d9-f6ed-43af-91e5-3d04cdcf692d" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of click attempts on URL's with detections split by the different threat types identified\r\nUrlClickEvents\r\n| where isnotempty(ThreatTypes)\r\n| summarize count() by ThreatTypes", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "33", "name": "query - 4", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "a356eac3-62c2-4fc9-a4d9-3b05b13848df" }, { "type": 1, "content": { "json": "### Trend (per {Granularity}) of URL Click Actions by Type
\r\n\r\n**Displays counts (per {Granularity}) of URL click events categorised by action type: Blocked, Allowed, Pending Verdict, Error Page, and Clicked Through. Helps identify risky user behaviour and policy gaps.**" }, "customWidth": "66", "name": "text - 13 - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "a91fe7a6-f507-48f7-bbcc-61dc4f998ba6" }, { "type": 1, "content": { "json": "### URL Clicks by Workload
\r\n\r\n**Displays counts (per {Granularity}) of URL click events grouped by Workload (e.g., Outlook, Teams, Copilot, Office Apps: Word, Excel, PowerPoint) Helps identify which applications are most frequently used for URL interactions and potential risk exposure.**" }, "customWidth": "33", "name": "text - 13 - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "ce05fa08-6e68-4c02-a0bf-2be6cdfae935" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises different URL click event types by action (e.g., blocked, allowed, pending verdict, error pages, and clicked through), summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where isnotempty(ActionType)\r\n| summarize ClickBlocked=countif(ActionType has_any(\"ClickBlocked\")), ClickAllowed=countif(ActionType has_any(\"ClickAllowed\")), PendingVerdict=countif(ActionType has_any(\"UrlScanInProgress\")), ErrorPage=countif(ActionType has_any(\"UrlErrorPage\")), ClickedThrough=countif(IsClickedThrough == true) by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ClickBlocked=coalesce(ClickBlocked,0), ClickAllowed=coalesce(ClickAllowed,0), PendingVerdict=coalesce(PendingVerdict,0), ErrorPage=coalesce(ErrorPage,0), ClickedThrough=coalesce(ClickedThrough,0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "xAxis": "Timestamp" } }, "customWidth": "66", "name": "query - 1", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "a12b4c78-7d18-4adc-86e0-54395d6a996a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises where URL clicks scanned by the Workload the click happened from\r\nUrlClickEvents\r\n| summarize count() by Workload", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "33", "name": "query - 5 - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "3237cd55-1d5c-41a9-a8f2-1d46c61a709e" }, { "type": 1, "content": { "json": "### Blocked URL Clicks by Workload (per {Granularity})
\r\n\r\n**Displays counts (per {Granularity}) of blocked URL click attempts grouped by Workload (Email, Teams, Office, Microsoft 365 Copilot). Helps identify which platforms are most exposed to malicious link interactions and where user awareness or policy enforcement should be strengthened.**" }, "customWidth": "66", "name": "text - 13 - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "1f209a83-3d50-4bb8-9a79-a365a50a4142" }, { "type": 1, "content": { "json": "### Click-Through Activity on Detected URLs by Workload
\r\n\r\n**Displays counts of click‑through actions on URLs already identified with detections, grouped by Workload where the click happened. Helps identify clients/platforms where users are most likely to proceed to risky URLs and prioritise awareness training or policy tuning for those workloads**" }, "customWidth": "33", "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "33592db8-0ff5-4d8e-bd8f-0201b81a4584" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises blocked URL click event types by Workload (e.g., Email, Teams, Office, Microsoft 365 Copilot), summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where ActionType ==\"ClickBlocked\"\r\n| summarize Teams=countif(Workload==\"Teams\"), Office=countif(Workload==\"Office\"), Email=countif(Workload==\"Email\"), Copilot=countif(Workload==\"Copilot\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, Teams=coalesce(Teams,0), Office=coalesce(Office,0), Email=coalesce(Email,0), Copilot=coalesce(Copilot,0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "customWidth": "66", "name": "query - 3", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "80241767-0f69-4e2e-9889-3bf1f48e4f02" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of click-through activities on URL's with detections split by the source client\r\nUrlClickEvents \r\n| where IsClickedThrough !=\"0\"\r\n| where isnotempty(ThreatTypes) \r\n| summarize count() by Workload", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "33", "name": "query - 2", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "fde29b46-2896-4bfc-bb61-09436696d738" }, { "type": 1, "content": { "json": "### Top clicks on Malicious URLs
\r\n\r\n**Displays the top 20 URLs associated with detections that registered the highest number of clicks. Includes ThreatTypes, ActionType, and Workload to provide context on the nature of the threat and where user interaction occurred.**" }, "customWidth": "100", "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "22bda63a-626c-47de-9a76-ad665ef87862" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query shows the top 20 URL's that have a detection associated with the most ammount of clicks registered \r\nUrlClickEvents\r\n| where ThreatTypes !=\"\"\r\n| summarize count() by Url, ThreatTypes, ActionType, Workload\r\n| top 20 by count_\r\n| project ['URL']=Url, ['Threat Types']=ThreatTypes, ['Action Type']=ActionType, Workload, ['Click Count']=count_", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Click Count", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "query - 10 - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "a044fd4e-7be6-4a11-974c-b54e417c2a81" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "5" }, "name": "group - 31-URL clicks", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "75e543f6-08c0-42ed-9869-ecd61b721d34" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Top Risky Users Clicking on URLs with Threats\r\n
\r\n\r\nThis section consolidates key visuals that track and identify users who have clicked on malicious URLs detected by Microsoft Defender for Office 365.

**Recommended action:** Enroll these users in security awareness training and verify Safe Links policy coverage for their mailboxes." }, "name": "text - 13 - Copy - Copy - Copy", "id": "19487811-a94b-4537-877e-61ac7e287c21" }, { "type": 1, "content": { "json": "### Top 10 Users Clicking on URLs with Malware Threat
\r\n\r\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Malware. Helps identify individuals at greater risk and prioritise targeted security awareness training.**" }, "customWidth": "100", "name": "text - 13 - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "78e10621-0e98-44c4-8399-810c19f138c2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the top 10 users with click attempts on URL's with malware detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),MalwareClickCount = countif(ThreatTypes has \"Malware\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(MalwareClickCount / todouble(TotalClickCount) *100, 2))\r\n| where MalwareClickCount !=0\r\n| sort by MalwareClickCount desc\r\n| top 15 by MalwareClickCount\r\n| project ['User']=AccountUpn, ['Malware Clicks']=MalwareClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Malware Clicks", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "25ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Clicks", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad Click %", "formatter": 4, "formatOptions": { "customColumnWidthSetting": "25ch", "palette": "red", "min": 0, "max": 20 }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "MalwareEmailCount", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "TotalEmailCount", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad_Traffic_Percentage_Inbound", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "sortBy": [] }, "customWidth": "100", "name": "query - 18 - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "a7ae8a75-ca7f-49be-8cad-d1451a3bd396" }, { "type": 1, "content": { "json": "### Top 10 Users Clicking on URLs with Phish Threat
\r\n\r\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Phish. Helps identify individuals at greater risk and prioritise targeted security awareness training.**" }, "customWidth": "100", "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "90d9a0c3-970a-4998-be62-3b3b84bb0f37" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the top 10 users with click attempts on URL's with Phish detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),PhishClickCount = countif(ThreatTypes has \"Phish\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(PhishClickCount / todouble(TotalClickCount) *100, 2))\r\n| where PhishClickCount !=0\r\n| sort by PhishClickCount desc\r\n| top 15 by PhishClickCount\r\n| project ['User']=AccountUpn, ['Phish Clicks']=PhishClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Phish Clicks", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "25ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Clicks", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad Click %", "formatter": 4, "formatOptions": { "customColumnWidthSetting": "25ch", "palette": "red", "min": 0, "max": 20 }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "MalwareClickCount", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "MalwareEmailCount", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "TotalEmailCount", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad_Traffic_Percentage_Inbound", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "sortBy": [] }, "customWidth": "100", "name": "query - 18 - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "d46877d9-03af-463a-b406-bb4c601dffeb" }, { "type": 1, "content": { "json": "### Top 10 Users Clicking on URLs with Spam Threat
\r\n\r\n**Displays the top 10 user accounts with the highest number of click attempts on URLs flagged as Spam. Helps identify individuals at greater risk and prioritise targeted security awareness training.**" }, "customWidth": "100", "name": "text - 13 - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "dc66e020-0932-4346-8e20-6a2dc78de7a9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the top 10 users with click attempts on URL's with Spam detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),SpamClickCount = countif(ThreatTypes has \"Spam\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(SpamClickCount / todouble(TotalClickCount) *100, 2))\r\n| where SpamClickCount !=0\r\n| sort by SpamClickCount desc\r\n| top 15 by SpamClickCount\r\n| project ['User']=AccountUpn, ['Spam Clicks']=SpamClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Spam Clicks", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "25ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Clicks", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad Click %", "formatter": 4, "formatOptions": { "customColumnWidthSetting": "25ch", "palette": "red", "min": 0, "max": 20 }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "PhishClickCount", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "MalwareClickCount", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "MalwareEmailCount", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "TotalEmailCount", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad_Traffic_Percentage_Inbound", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "count_", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "50ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "sortBy": [] }, "customWidth": "100", "name": "query - 18 - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "734ee45e-4dff-4ca1-b17d-02389086b17b" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "5" }, "name": "group - 32-Top clickers", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "ee6c3413-28be-49a1-a89d-bf5fce7acfa4" }, { "type": 1, "content": { "json": "# Microsoft Teams Collaboration Protection\r\n\r\n---\r\nAs email defenses mature, attackers are shifting into **Microsoft Teams**, where messages bypass secure email gateways and carry the implicit trust of a colleague chat. Microsoft Threat Intelligence reports Teams-based phishing and voice phishing (vishing) rising steadily through 2026, most often as **IT help desk or technical-support impersonation** from external or newly-created tenants, used to steer users toward remote-access tools and credential theft.\r\n\r\nThis tab shows **Microsoft Defender for Office 365** protection for Microsoft Teams: threat detections and impersonation, suspicious external senders, malicious URLs and clicks, malicious files, post-delivery ZAP removals, and user and admin submissions across chats and channels.\r\n\r\n**Recommended action:** Treat unsolicited external help desk or IT support contact as suspicious. Restrict inbound chat from unmanaged and consumer tenants, allowlist trusted external domains, remove or restrict remote-support tools such as Quick Assist where they are not required, and enforce phishing-resistant MFA for all users (Conditional Access with authentication strength), prioritizing privileged and administrator accounts first.\r\n\r\n[

Disrupting threats targeting Microsoft Teams

](https://www.microsoft.com/en-us/security/blog/2025/10/07/disrupting-threats-targeting-microsoft-teams/)[

Cross-tenant helpdesk impersonation to data exfiltration: a human-operated intrusion playbook

](https://www.microsoft.com/en-us/security/blog/2026/04/18/crosstenant-helpdesk-impersonation-data-exfiltration-human-operated-intrusion-playbook/)[

Help on the line: how a Microsoft Teams support call led to compromise

](https://www.microsoft.com/en-us/security/blog/2026/03/16/help-on-the-line-how-a-microsoft-teams-support-call-led-to-compromise/)[

Email threat landscape: Q2 2026 trends and insights

](https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/)" }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "14" }, "name": "text - teams description", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "5c0f0100-0a11-4b22-9c33-000000000100" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Headline Microsoft Teams protection metrics for the selected period, with per-interval sparklines. Messages are de-duplicated to the latest record per Teams message.\r\nlet gran = {Granularity};\r\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\r\nlet zap = materialize(MessagePostDeliveryEvents);\r\nunion\r\n(msgs | summarize Count = count() | extend Details = \"Teams Messages Scanned\", Ord = 1, Trend = toscalar(msgs | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Messages with Threats\", Ord = 2, Trend = toscalar(msgs | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Phish\" | summarize Count = count() | extend Details = \"Phish Detections\", Ord = 3, Trend = toscalar(msgs | where ThreatTypes has \"Phish\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Malware\" | summarize Count = count() | extend Details = \"Malware Detections\", Ord = 4, Trend = toscalar(msgs | where ThreatTypes has \"Malware\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Spam\" | summarize Count = count() | extend Details = \"Spam Detections\", Ord = 5, Trend = toscalar(msgs | where ThreatTypes has \"Spam\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where SafetyTip == \"URLMessageWarning\" | summarize Count = count() | extend Details = \"Messages with URL Warning\", Ord = 6, Trend = toscalar(msgs | where SafetyTip == \"URLMessageWarning\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(zap | summarize Count = count() | extend Details = \"Post-Delivery ZAP Actions\", Ord = 7, Trend = toscalar(zap | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 21 }, "showBorder": true, "size": "auto" } }, "customWidth": "100", "name": "teams kpi tiles", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "b2c476ca-4141-43b4-9d4e-98470aa432fc", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "14" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Microsoft Teams - Collaboration Protection Overview\r\n
\r\n\r\nMicrosoft Defender for Office 365 extends its protection to **Microsoft Teams**, detecting malicious messages, URLs, and files shared through chats and channels. This tab summarizes Teams message detections, link-safety warnings, post-delivery ZAP, file scanning, and user/admin submissions.

*Scope note: the Teams message tables surface metadata for external-conversation messages plus internal messages that contain URLs, so counts reflect that scope rather than the full volume of Teams messages.*" }, "name": "teams overview banner", "id": "2f71360f-1673-480f-8361-5afc83aee67d" }, { "type": 1, "content": { "json": "### Teams threat detections over time
\r\n\r\n**Volume (per selected interval) of Microsoft Teams messages detected with a threat by Microsoft Defender for Office 365. Spikes may indicate a targeted Teams-based campaign.**" }, "customWidth": "100", "name": "teams trend header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "0ac71d4e-8ecb-4d17-9fd3-10754007ec07" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the number of Microsoft Teams messages detected with a threat over time, de-duplicated to the latest record per message and summarized per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(MessageEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(MessageEvents | summarize max(Timestamp));\r\nlet agg = materialize(MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId | summarize ThreatDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ThreatDetections = coalesce(ThreatDetections, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "xAxis": "Timestamp", "seriesLabelSettings": [ { "seriesName": "ThreatDetections", "color": "blueDark" } ] } }, "customWidth": "100", "name": "teams detection trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "937f3bc6-21f5-4f4c-ab72-78f08f32c5bd" }, { "type": 1, "content": { "json": "### Threat type breakdown
\r\n\r\n**Split of Microsoft Teams threat detections across Phish, Malware, and Spam.**" }, "customWidth": "50", "name": "teams threat pie header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "645a39ae-843a-47db-8016-6082ef37744d" }, { "type": 1, "content": { "json": "### Thread exposure
\r\n\r\n**De-duplicated Microsoft Teams messages split by whether the conversation includes external participants.**" }, "customWidth": "50", "name": "teams thread header", "id": "a1a48f9a-8593-4ab5-8824-5998c643e844" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query breaks down Microsoft Teams threat detections by threat type for the selected period, de-duplicated to the latest record per message. A message flagged for more than one threat type is counted under each, so the split can exceed the distinct message count.\r\nlet msgs = MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId;\r\nunion\r\n(msgs | where ThreatTypes has \"Phish\" | summarize Count = count() | extend ThreatType = \"Phish\"),\r\n(msgs | where ThreatTypes has \"Malware\" | summarize Count = count() | extend ThreatType = \"Malware\"),\r\n(msgs | where ThreatTypes has \"Spam\" | summarize Count = count() | extend ThreatType = \"Spam\")\r\n| project ThreatType, Count", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "teams threat type pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "029b4ecc-cd95-4385-a251-8ab194add8f4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants.\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| extend Thread = iif(IsExternalThread == true, \"External Thread\", \"Internal Thread\")\r\n| summarize Count = count() by Thread", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "teams thread pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "1581f447-9b3e-4857-84b8-e78b5df65ac5" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "14" }, "name": "group - Teams Overview", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "283f36b2-5c54-4afe-9a87-33d4796bd5b7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Teams Calls and Vishing (Voice Phishing)\r\n
\r\n\r\n**Voice phishing (vishing) over Microsoft Teams is the fastest-growing collaboration threat of 2026. Attackers impersonate IT help desk or support and call users directly, often after a chat lure, to talk them into granting remote access or entering credentials. Because a target must be online to answer, malicious calls cluster in working hours. This section surfaces Teams call activity, when calls happen, and callers using support or brand-impersonation identities.**

*Interim data source: Teams call activity is currently read from Microsoft Defender for Cloud Apps call telemetry (CloudAppEvents). It will move to the dedicated CallActivityEvents table once that table is available to stream into Microsoft Sentinel.*

**Recommended action:** Treat unsolicited help desk or support calls as suspicious. Confirm any request through a known internal channel, and never grant remote access such as Quick Assist on the strength of an inbound Teams call. Restrict inbound calls and chat from unmanaged and consumer tenants." }, "customWidth": "100", "name": "teams calls banner", "id": "9815bdc9-9e10-4e84-9164-783092b4ccb0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Teams call and vishing headline metrics for the selected period, with per-interval sparklines. Interim source: Defender for Cloud Apps call telemetry (CloudAppEvents / CallParticipantDetail).\r\nlet gran = {Granularity};\r\nlet calls = materialize(CloudAppEvents | where ActionType == \"CallParticipantDetail\" | extend R = parse_json(RawEventData) | extend CallId = tostring(R.CallId), UId = tolower(tostring(R.UserId)));\r\nlet susp = calls | extend Local = tostring(split(UId, \"@\")[0]), Dom = tostring(split(UId, \"@\")[1]) | where Local matches regex @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\" or Dom endswith \".onmicrosoft.com\";\r\nlet reported = CloudAppEvents | where ActionType == \"CallReported\";\r\nunion\r\n(calls | summarize Count = dcount(CallId) | extend Details = \"Teams Calls\", Ord = 1, Trend = toscalar(calls | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(susp | summarize Count = dcount(UId) | extend Details = \"Impersonation-style Callers\", Ord = 2, Trend = toscalar(susp | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(reported | summarize Count = count() | extend Details = \"Reported Suspicious Calls\", Ord = 3, Trend = toscalar(reported | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 21 }, "showBorder": true, "size": "auto" }, "showAnalytics": true }, "customWidth": "100", "name": "teams calls kpi", "id": "be8946d9-1eae-405c-b8df-cee2242cb44d" }, { "type": 1, "content": { "json": "### Teams call activity over time
\r\n**Distinct Microsoft Teams calls per selected interval. A sudden rise, or calls outside normal working hours, can indicate a vishing campaign in progress.**" }, "customWidth": "100", "name": "teams calls trend header", "id": "1b49c98f-e5d9-457c-b058-a195e89eac0e" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Distinct Teams calls per interval (interim source: CloudAppEvents / CallParticipantDetail).\r\nCloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend CallId = tostring(R.CallId)\r\n| summarize ['Teams Calls'] = dcount(CallId) by Timestamp = bin(Timestamp, {Granularity})\r\n| sort by Timestamp asc", "size": 0, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "xAxis": "Timestamp", "seriesLabelSettings": [ { "seriesName": "Teams Calls", "color": "blueDark" } ] }, "showAnalytics": true }, "customWidth": "100", "name": "teams calls trend", "id": "7538b3ca-b96d-421a-9cdc-69b8aef4b185" }, { "type": 1, "content": { "json": "### When calls happen (hour of day, UTC)
\r\n**Microsoft Teams calls by the hour of day they started (UTC), listed 00:00 through 23:00. The bar length is the number of calls that started in that hour across the selected period. Vishing calls cluster in working hours because the target must be online to answer, with the heaviest malicious-call activity between 14:00 and 20:00 UTC, Monday to Friday, according to Microsoft Threat Intelligence. Use this to baseline normal call timing and spot unusual off-hours spikes.**" }, "customWidth": "100", "name": "teams calls hour header", "id": "6bc095e9-fe0d-4f6f-81bd-f3374d758229" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Teams calls by start hour of day (UTC), all 24 hours 00:00..23:00 in order (interim source: CloudAppEvents / CallParticipantDetail).\r\nlet data = CloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend JoinTime = todatetime(R.JoinTime), CallId = tostring(R.CallId)\r\n| where isnotempty(JoinTime) and isnotempty(CallId)\r\n| summarize CallStart = min(JoinTime) by CallId\r\n| extend HourUTC = hourofday(CallStart)\r\n| summarize Calls = count() by HourUTC;\r\nrange HourUTC from 0 to 23 step 1\r\n| join kind=leftouter (data) on HourUTC\r\n| extend Calls = coalesce(Calls, 0)\r\n| extend HourLabel = strcat(iif(HourUTC < 10, strcat(\"0\", tostring(HourUTC)), tostring(HourUTC)), \":00\")\r\n| order by HourUTC asc\r\n| project ['Hour of Day (UTC)'] = HourLabel, ['Teams Calls'] = Calls", "size": 0, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "Teams Calls", "formatter": 3, "formatOptions": { "palette": "blueDark", "customColumnWidthSetting": "360px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] }, "showAnalytics": true }, "customWidth": "100", "name": "teams calls hour", "id": "c36a9909-5570-4fe7-8efc-1b9b4745713a" }, { "type": 1, "content": { "json": "### Suspicious callers (support and helpdesk impersonation)
\r\n**Teams call participants whose display name or address looks like IT support, help desk, or a well-known brand (for example \"Microsoft IT support\", \"Help Desk\", \"Office 365 Support\"), or who dial in from a throwaway `.onmicrosoft.com` tenant. Origin shows whether the caller is external, an external throwaway tenant, or inside your own tenant. External and throwaway-tenant callers are the primary vishing risk; own-tenant matches are frequently a legitimate internal help desk and should be confirmed rather than assumed malicious.**

**Recommended action:** Prioritise External and `.onmicrosoft` callers, confirm none are legitimate, and warn the users they called. Genuine IT support does not cold-call staff over Teams to request remote access." }, "customWidth": "100", "name": "teams calls susp header", "id": "aa420b5f-efd2-4da5-ab41-192031f62ed1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Suspicious Teams callers by impersonation-style DISPLAY NAME or address (Attendees[].DisplayName / UPN), with Origin from the org's own accepted (EmailEvents inbound) domains - no tenant-id anchor. Interim source: CloudAppEvents / CallParticipantDetail.\r\nlet suspRegex = @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\";\r\nlet ownDomains = toscalar(EmailEvents | where EmailDirection == \"Inbound\" | extend RD = tolower(tostring(split(RecipientEmailAddress, \"@\")[1])) | where isnotempty(RD) | summarize make_set(RD, 200));\r\nlet calls = CloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend CallId = tostring(R.CallId), JoinTime = todatetime(R.JoinTime), Attendees = R.Attendees\r\n| where isnotempty(CallId);\r\nlet callAtt = calls | summarize Attendees = take_any(Attendees), JoinTime = min(JoinTime) by CallId;\r\ncallAtt\r\n| mv-expand Att = Attendees\r\n| extend Caller = tolower(tostring(Att.UPN)), CallerName = tostring(Att.DisplayName)\r\n| extend CallerDom = tostring(split(Caller, \"@\")[1])\r\n| where isnotempty(Caller)\r\n| extend SuspName = CallerName matches regex suspRegex or Caller matches regex suspRegex\r\n| where SuspName or CallerDom endswith \".onmicrosoft.com\"\r\n| extend Origin = case(CallerDom endswith \".onmicrosoft.com\", \"External (.onmicrosoft throwaway)\", set_has_element(ownDomains, CallerDom), \"Own tenant\", \"External\")\r\n| summarize CallsPlaced = dcount(CallId), FirstSeen = min(JoinTime), LastSeen = max(JoinTime) by CallerName, Caller, Origin\r\n| extend OriginRank = case(Origin == \"External (.onmicrosoft throwaway)\", 0, Origin == \"External\", 1, 2)\r\n| sort by OriginRank asc, CallsPlaced desc\r\n| take 10\r\n| project ['Caller Display Name'] = CallerName, ['Caller Address'] = Caller, ['Origin'] = Origin, ['Calls Placed'] = CallsPlaced, ['First Seen'] = FirstSeen, ['Last Seen'] = LastSeen", "size": 0, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "Calls Placed", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] }, "showAnalytics": true }, "customWidth": "100", "name": "teams calls susp table", "id": "d1c4df7b-db07-4c4c-bc71-dfd8623cd704" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "14" }, "name": "group - Teams Calls and Vishing", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "1d133411-9b5c-4ede-8502-68b3b02262e4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Teams Impersonation & Identity Deception\r\n
\r\n\r\nMicrosoft Defender for Office 365 flags Teams messages where a sender impersonates a brand, a specific person, or a trusted domain. Impersonation is the entry point for most Teams social-engineering: attackers pose as IT, executives, or Microsoft to build trust before delivering a malicious link or request. These visuals expose who is being impersonated, who is being targeted, and the infrastructure (display names, look-alike domains, and URLs) behind the campaigns so you can hunt IOCs and coach at-risk users.

**Recommended action:** Treat the impersonated display names and look-alike domains below as IOCs to hunt, and prioritize the Microsoft Defender alert *Microsoft Teams chat initiated by a suspicious external user*. Teach users that a Teams display name is not proof of identity: verify the real sender domain, and confirm any help desk, executive, or Microsoft support request through a known internal channel before acting." }, "name": "teams imp banner", "id": "7ff04ff3-9f2d-4a49-8383-2b542d78fe9b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n FakeDisplayName = tostring(RD.Sender.DisplayName),\r\n FakeSenderAddress = tostring(RD.Sender.UPN),\r\n ChatThreadId = tostring(RD.ChatThreadId),\r\n TargetUser = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nunion\r\n(imp | summarize Count=count() | extend Details=\"Impersonation Detections\", Ord=1),\r\n(imp | summarize Count=dcount(FakeSenderAddress) | extend Details=\"Distinct Fake Senders\", Ord=2),\r\n(imp | summarize Count=dcount(TargetUser) | extend Details=\"Targeted Users\", Ord=3),\r\n(imp | summarize Count=dcount(ImpersonationType) | extend Details=\"Impersonation Types\", Ord=4)\r\n| sort by Ord asc | project Count, Details", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full" } }, "customWidth": "100", "name": "teams imp tiles", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "e37f94d5-9bcc-432e-aa66-25831603c228" }, { "type": 1, "content": { "json": "### Impersonation over time, by type
\r\n\r\n**Trend of Brand, User, and Domain impersonation detections. A spike in a single type often marks the start of a targeted campaign.**" }, "customWidth": "100", "name": "teams imp trend header", "id": "09907f5b-5c20-4a7e-86d3-c89153c4df98" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n FakeDisplayName = tostring(RD.Sender.DisplayName),\r\n FakeSenderAddress = tostring(RD.Sender.UPN),\r\n ChatThreadId = tostring(RD.ChatThreadId),\r\n TargetUser = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Count=count() by ImpersonationType, Timestamp=bin(Timestamp, {Granularity}) | sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "xAxis": "Timestamp" } }, "customWidth": "100", "name": "teams imp trend", "id": "757204b1-e900-4217-a2ff-2224a033fdcc" }, { "type": 1, "content": { "json": "### Suspicious external senders (impersonation and throwaway tenants)
\r\n**External Microsoft Teams senders flagged as likely impersonation: throwaway `.onmicrosoft.com` tenants and/or help desk, IT support, security, admin, or account/update-themed display names. Attackers rotate through many such identities (for example numbered `ithelpdesk@...` addresses) from newly-created or consumer tenants to pose as internal support, frequently before the Defender impersonation detector assigns a verdict. This heuristic complements that detector.**

**Recommended action:** Review high threat-rate senders, block the sending domains, and remind users that genuine IT support does not cold-contact them from an external tenant; verify any such request through a known internal channel." }, "customWidth": "100", "name": "teams susp senders header", "id": "5df4af86-49e9-4fc7-b6ad-76d3ef3f7da6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//External Teams senders flagged as likely impersonation: throwaway .onmicrosoft.com tenants and/or help desk / IT / admin / update-themed display names, ranked by messages carrying a threat.\r\nMessageEvents\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tolower(tostring(split(SenderEmailAddress, \"@\")[1]))\r\n| extend IsOnMicrosoft = SenderDomain endswith \".onmicrosoft.com\"\r\n| extend SuspName = SenderDisplayName matches regex @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|it team|administrator|sys ?admin|security|microsoft|maintenance|support|update|verif|account|password|mfa\"\r\n| where IsOnMicrosoft or SuspName\r\n| summarize TeamsMessages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by SenderDisplayName, SenderEmailAddress, SenderDomain, IsOnMicrosoft, SuspName\r\n| extend WhyFlagged = case(IsOnMicrosoft and SuspName, \"Throwaway .onmicrosoft tenant + helpdesk-style name\", IsOnMicrosoft, \"Throwaway .onmicrosoft tenant\", \"Helpdesk / IT-style display name\")\r\n| extend ThreatPct = round(todouble(ThreatMessages) * 100 / TeamsMessages, 1)\r\n| project ['Sender Display Name']=SenderDisplayName, ['Sender Address']=SenderEmailAddress, ['Why Flagged']=WhyFlagged, ['Teams Messages']=TeamsMessages, ['Threat Messages']=ThreatMessages, ['Threat %']=ThreatPct, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\r\n| sort by ['Threat Messages'] desc, ['Teams Messages'] desc\r\n| take 10", "size": 0, "title": "", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "Teams Messages", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Threat Messages", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Threat %", "formatter": 4, "formatOptions": { "palette": "red", "min": 0, "max": 100 }, "numberFormat": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] }, "showAnalytics": true }, "customWidth": "100", "name": "teams susp senders table", "id": "dd1d79d8-f591-4aae-bd44-6ad23a3e0ae4" }, { "type": 1, "content": { "json": "### Who is being targeted
\r\n\r\n**Internal users receiving the most impersonation attempts. Concentrated targeting of a few users is a strong signal of a deliberate campaign - prioritize these users for security awareness training.**" }, "customWidth": "100", "name": "teams imp targets header", "id": "43112ad1-ebc9-42fb-9ebd-0dbaa862ed45" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n FakeDisplayName = tostring(RD.Sender.DisplayName),\r\n FakeSenderAddress = tostring(RD.Sender.UPN),\r\n ChatThreadId = tostring(RD.ChatThreadId),\r\n TargetUser = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Distinct Fake Senders']=dcount(FakeSenderAddress), Types=make_set(ImpersonationType,3), ['Last Seen']=max(Timestamp) by ['Targeted User']=TargetUser | top 10 by Detections", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true } }, "customWidth": "100", "name": "teams imp targets", "id": "cc4b3f98-bfcb-4741-9abb-9ff099eb946f" }, { "type": 1, "content": { "json": "### Impersonating senders
\r\n\r\n**The identities behind the impersonation, grouped by fake display name, sender domain, and type. Attackers rotate through many sending addresses under a single display name - Distinct Sender Addresses exposes that rotation, and a high count is itself a strong bulk-campaign signal. Use First/Last Seen to scope the campaign window.**" }, "customWidth": "100", "name": "teams imp senders header", "id": "99859796-7b69-42e7-a27a-541e0ba86cb2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists the identities behind Teams impersonation, grouped by the fake display name, sender domain, and impersonation type. Attackers rotate through many sending addresses under one display name, so Distinct Sender Addresses reveals bulk campaigns that per-address ranking would hide.\r\nlet imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n FakeDisplayName = tostring(RD.Sender.DisplayName),\r\n FakeSenderAddress = tostring(RD.Sender.UPN),\r\n TargetUser = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp\r\n| summarize Detections=count(), SenderAddresses=dcount(FakeSenderAddress), Targets=dcount(TargetUser), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by FakeDisplayName, FakeSenderDomain, ImpersonationType\r\n| top 10 by Detections\r\n| project ['Fake Display Name']=FakeDisplayName, ['Sender Domain']=FakeSenderDomain, ['Impersonation Type']=ImpersonationType, ['Distinct Sender Addresses']=SenderAddresses, Detections, ['Targeted Users']=Targets, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "Distinct Sender Addresses", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Detections", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] } }, "customWidth": "100", "name": "teams imp senders", "id": "209439a0-5be3-4e41-abe9-695552730dc8" }, { "type": 1, "content": { "json": "### Display names abused
\r\n\r\n**The identities attackers pretend to be (for example \"IT HelpDesk\", \"Microsoft Support\"). These are the trust anchors of the social-engineering lure.**" }, "customWidth": "100", "name": "teams imp names header", "id": "e645578b-7a52-4d38-9d83-f5c500bbfe1a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n FakeDisplayName = tostring(RD.Sender.DisplayName),\r\n FakeSenderAddress = tostring(RD.Sender.UPN),\r\n ChatThreadId = tostring(RD.ChatThreadId),\r\n TargetUser = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Distinct Senders']=dcount(FakeSenderAddress) by ['Fake Display Name']=FakeDisplayName | top 10 by Detections", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "Detections", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Distinct Senders", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] } }, "customWidth": "100", "name": "teams imp names", "id": "d723d72b-4e7c-431b-ae7b-980879c8bd75" }, { "type": 1, "content": { "json": "### Look-alike sender domains
\r\n\r\n**Sending domains used for impersonation - watch for typosquats (for example rnicrosoft.com for m→rn). Add confirmed domains to your Tenant Allow/Block List.**" }, "customWidth": "100", "name": "teams imp domains header", "id": "98040a5a-bbd5-4c95-b976-5630ce48b282" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n FakeDisplayName = tostring(RD.Sender.DisplayName),\r\n FakeSenderAddress = tostring(RD.Sender.UPN),\r\n ChatThreadId = tostring(RD.ChatThreadId),\r\n TargetUser = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Display Names Used']=dcount(FakeDisplayName) by ['Sender Domain']=FakeSenderDomain | top 10 by Detections", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "Detections", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Display Names Used", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] } }, "customWidth": "100", "name": "teams imp domains", "id": "94b9fa45-c889-46a7-8b80-92e5d280ad3b" }, { "type": 1, "content": { "json": "### URL IOCs from impersonation messages
\r\n\r\n**URL domains that appeared in messages sent by impersonating senders. Threat actors deliberately mix legitimate domains (for example microsoft.com or google.com) with their malicious ones to make the lure look trustworthy, so treat this as a review list - not a blocklist. Investigate the unfamiliar or look-alike domains and block only those you confirm malicious; never block a well-known legitimate domain from this list.**" }, "customWidth": "100", "name": "teams imp ioc header", "id": "d5f4886c-7c7e-4c6f-94ca-569cabda5ede" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists URL domains that appeared in messages sent by impersonating senders, with a breakdown of how many carried Malware, Phish, or Spam verdicts. Threat actors mix legitimate and malicious domains in a single lure, so review the unfamiliar or look-alike domains and block only confirmed-malicious ones.\r\nlet imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ChatThreadId = tostring(RD.ChatThreadId);\r\nlet impThreads = imp | distinct ChatThreadId;\r\nlet impMsgs = MessageEvents\r\n | where ThreadId in (impThreads)\r\n | summarize arg_max(Timestamp, *) by TeamsMessageId\r\n | project TeamsMessageId, ThreatTypes;\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| join kind=inner (impMsgs) on TeamsMessageId\r\n| summarize ['URL Count']=count(), Messages=dcount(TeamsMessageId), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\") by ['URL Domain']=UrlDomain\r\n| top 10 by ['URL Count']", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "URL Count", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Messages", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Malware", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Phish", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Spam", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] } }, "customWidth": "100", "name": "teams imp ioc", "id": "958ac65c-d56d-4a80-ba83-2ab33e8b1e2e" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "14" }, "name": "group - Teams Impersonation", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "c49582db-6318-423f-b806-91cbeb625ea2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Malicious URLs and Link Warnings in Teams\r\n
\r\n\r\nTracks URLs shared through Microsoft Teams, messages that triggered a Microsoft Defender for Office 365 URL safety-tip warning, and the outcome of Teams URL clicks (allowed versus blocked) captured in UrlClickEvents.

**Recommended action:** Enable Safe Links for Microsoft Teams so links are checked at click time, and prioritize *User clicked a malicious link in Teams chat* alerts for investigation. Treat a blocked click as an attempted compromise: check whether the user went on to share credentials or run a file, and reset credentials where warranted." }, "name": "teams url banner", "id": "e3ec4d65-8d1f-4303-bd8f-eb1ae521da41" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query surfaces Microsoft Teams URL-sharing and link-warning metrics for the selected period. URL-warning messages carry the Microsoft Defender for Office 365 URL safety tip.\r\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\r\nunion\r\n(msgs | where SafetyTip == \"URLMessageWarning\" | summarize Count = count() | extend Details = \"Messages with URL Warning\", Ord = 1),\r\n(MessageUrlInfo | summarize Count = count() | extend Details = \"URLs Shared in Messages\", Ord = 2),\r\n(MessageUrlInfo | summarize Count = dcount(TeamsMessageId) | extend Details = \"Messages Containing URLs\", Ord = 3),\r\n(MessageUrlInfo | summarize Count = dcount(UrlDomain) | extend Details = \"Distinct URL Domains\", Ord = 4)\r\n| sort by Ord asc\r\n| project Count, Details", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full" } }, "customWidth": "100", "name": "teams url tiles", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "b71382c7-c0f7-4f9d-9d21-e0a8bf9504ff" }, { "type": 1, "content": { "json": "### Teams URL click outcomes over time
\r\n\r\n**Allowed versus blocked Microsoft Teams URL clicks (per selected interval) from UrlClickEvents where the click happened in the Teams workload.**" }, "customWidth": "66", "name": "teams click trend header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "30818e0d-6c4b-4868-896a-ac48cb3cef86" }, { "type": 1, "content": { "json": "### Click outcomes
\r\n\r\n**Distribution of Microsoft Teams URL click actions by type.**" }, "customWidth": "33", "name": "teams click pie header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "5a882138-2241-4527-80b8-9983c5807050" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises Microsoft Teams URL click outcomes over time (allowed vs blocked) using the UrlClickEvents workload filter, summarizing the data per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(UrlClickEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(UrlClickEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where Workload == \"Teams\"\r\n| summarize ClickAllowed = countif(ActionType has \"ClickAllowed\"), ClickBlocked = countif(ActionType has \"ClickBlocked\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ClickAllowed = coalesce(ClickAllowed, 0), ClickBlocked = coalesce(ClickBlocked, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "xAxis": "Timestamp" } }, "customWidth": "66", "name": "teams click trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "7a2f5559-1e3e-412a-addf-c3bf6be98502" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query shows Microsoft Teams URL click outcomes by action type for the selected period.\r\nUrlClickEvents\r\n| where Workload == \"Teams\"\r\n| where isnotempty(ActionType)\r\n| summarize Count = count() by ActionType", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "33", "name": "teams click pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "889c6bb3-438b-4575-84f2-084c1b5fd1f4" }, { "type": 1, "content": { "json": "### Top domains shared in Teams messages
\r\n\r\n**The 10 most-shared URL domains in Microsoft Teams messages, with the number of messages each appeared in.**" }, "customWidth": "100", "name": "teams top domains header", "id": "dcb8c87c-087e-4d69-b7b7-0329296293ff" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists the top 10 URL domains shared in Microsoft Teams messages by volume for the selected period.\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| summarize UrlCount = count(), Messages = dcount(TeamsMessageId) by UrlDomain\r\n| top 10 by UrlCount\r\n| project ['URL Domain']=UrlDomain, ['URLs Shared']=UrlCount, ['Messages']=Messages", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "URLs Shared", "formatter": 3, "formatOptions": { "palette": "redDark" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "teams top domains table", "id": "7561adb0-1fbe-41ce-a924-a27bcd4c5c12" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "14" }, "name": "group - Teams Malicious URLs", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "6d47c309-be9e-4b21-940e-7c7b282e5dc2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Targeted Users & Risky Senders\r\n
\r\n\r\nIdentifies who is most targeted in Microsoft Teams, and profiles the external senders and domains behind risky messages - URL safety-tip warnings, first-contact senders, threat-carrying domains, and low-reputation link infrastructure - so you can spot anomalous senders before they succeed.

**Recommended action:** Prioritize the most-targeted users for phishing-resistant MFA and awareness coaching, and treat first-contact external senders and low-reputation domains as IOCs. Restrict inbound chat from unmanaged and consumer tenants, and allowlist only trusted external domains so unsolicited outsiders cannot start a conversation." }, "name": "teams risky banner", "id": "0aa13d73-2e13-487c-a7c4-d90464a554d4" }, { "type": 1, "content": { "json": "### Top targeted users (messages with threats)
\r\n\r\n**The 10 users receiving the most Microsoft Teams messages that contained a threat, expanded from each message recipient list.**" }, "customWidth": "100", "name": "teams targeted header", "id": "827dc0f6-2bb2-49b9-acf8-d7b400238594" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists the top 10 users receiving Microsoft Teams messages that contained a threat, expanded from the message recipient list, with each user's total Teams messages received and the share that carried a threat. Messages are de-duplicated to the latest record per message.\r\nlet expanded = MessageEvents\r\n | summarize arg_max(Timestamp, *) by TeamsMessageId\r\n | mv-expand rd = parse_json(RecipientDetails)\r\n | extend Recipient = tostring(rd.RecipientSmtpAddress)\r\n | where isnotempty(Recipient);\r\nlet totals = expanded | summarize TotalMessages = count() by Recipient;\r\nexpanded\r\n| where isnotempty(ThreatTypes)\r\n| summarize ThreatMessages = count() by Recipient\r\n| join kind=leftouter (totals) on Recipient\r\n| extend ThreatPct = round(100.0 * ThreatMessages / TotalMessages, 1)\r\n| top 10 by ThreatMessages\r\n| project ['Recipient']=Recipient, ['Threat Messages']=ThreatMessages, ['Total Messages']=TotalMessages, ['Threat %']=ThreatPct", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Threat Messages", "formatter": 3, "formatOptions": { "palette": "redDark" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "teams targeted users table", "id": "79481d1b-617e-46df-b555-9f7240932dd0" }, { "type": 1, "content": { "json": "### Top senders of URL-warning messages
\r\n\r\n**Senders whose Microsoft Teams messages most often triggered a URL safety-tip warning.**" }, "customWidth": "50", "name": "teams warn senders header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "ef71d7dd-4442-4992-977d-d550aad4533c" }, { "type": 1, "content": { "json": "### Top domains in URL-warning messages
\r\n\r\n**URL domains most frequently present in Microsoft Teams messages that triggered a URL safety-tip warning.**" }, "customWidth": "50", "name": "teams warn domains header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "6f41a4ba-f832-4947-ad27-cd6b8015bd63" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists the top 10 senders whose Microsoft Teams messages triggered a URL safety-tip warning for the selected period, with each sender's total Teams messages and the share that carried a warning. Messages are de-duplicated to the latest record per message.\r\nlet dedup = MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId;\r\nlet totals = dedup | summarize TotalMessages = count() by SenderEmailAddress;\r\ndedup\r\n| where SafetyTip == \"URLMessageWarning\"\r\n| summarize WarningMessages = count() by SenderEmailAddress\r\n| join kind=leftouter (totals) on SenderEmailAddress\r\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\r\n| top 10 by WarningMessages\r\n| project ['Sender']=SenderEmailAddress, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Warning Messages", "formatter": 3, "formatOptions": { "palette": "redDark" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "50", "name": "teams warn senders table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "3fa023af-79e3-407f-ac20-b0aa6e3ba511" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists the top 10 URL domains appearing in Microsoft Teams messages that triggered a URL safety-tip warning, with the domain's total message appearances and the share that carried a warning.\r\nlet warned = MessageEvents | where SafetyTip == \"URLMessageWarning\" | distinct TeamsMessageId;\r\nlet totals = MessageUrlInfo | where isnotempty(UrlDomain) | summarize TotalMessages = dcount(TeamsMessageId) by UrlDomain;\r\nMessageUrlInfo\r\n| where TeamsMessageId in (warned)\r\n| summarize WarningMessages = dcount(TeamsMessageId) by UrlDomain\r\n| join kind=leftouter (totals) on UrlDomain\r\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\r\n| top 10 by WarningMessages\r\n| project ['URL Domain']=UrlDomain, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Warning Messages", "formatter": 3, "formatOptions": { "palette": "redDark" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "50", "name": "teams warn domains table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "68811015-1383-48ad-86da-4f8f9d39e4c4" }, { "type": 1, "content": { "json": "### First-contact external senders
\r\n\r\n**External Microsoft Teams senders ordered by when they were first seen in the period (most recent first). Note: some flows tag internal-domain senders as external - to hide your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**" }, "customWidth": "100", "name": "teams fc senders header", "id": "0f131ff3-d6b2-4187-b86c-ca3493594b54" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists external Microsoft Teams senders by the date they were first seen in the selected period, surfacing recent first-contact senders. Messages are de-duplicated to the latest record per message. In tenants with longer history this highlights genuinely new senders.\r\n// TIP: IsExternalThread may still surface senders from your own accepted domains. To hide them,\r\n// uncomment the ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n//| where tostring(split(SenderEmailAddress, \"@\")[1]) !in~ (ExcludeDomains)\r\n| summarize FirstSeen = min(Timestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderEmailAddress\r\n| top 10 by FirstSeen desc\r\n| project ['Sender']=SenderEmailAddress, ['First Seen']=FirstSeen, ['Messages']=Messages, ['Threat Messages']=ThreatMessages", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Threat Messages", "formatter": 3, "formatOptions": { "palette": "redDark" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true, "sortBy": [ { "itemKey": "Threat Messages", "sortOrder": 2 } ] } }, "customWidth": "100", "name": "teams fc senders table", "id": "4e10a78d-8858-4dbb-9db0-e7b7d7e7636c" }, { "type": 1, "content": { "json": "### External sender-domain risk
\r\n\r\n**External sending domains ranked by threat volume, with the mix of conversation types (1:1 chat, group chat, channel), threat breakdown, threat rate, count of messages carrying low-reputation URLs (domains on commonly-abused TLDs such as .xyz, .top, .click, .shop, .zip), and first/last-seen. A domain that is new in the period, skews toward 1:1 chats, or shows a high threat rate is anomalous and warrants review. Note: to exclude your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**" }, "customWidth": "100", "name": "teams anomaly header", "id": "a91295db-8192-4828-93c5-408436e4b0e1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query ranks external sender domains in Microsoft Teams by threat volume for the selected period, split by conversation type (1:1 chat, group chat, channel), with threat-type breakdown, threat rate, and a count of messages carrying low-reputation URL TLDs. Messages are de-duplicated to the latest record per message. New, 1:1-skewed, or high-threat-rate domains are the anomalies to review.\r\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\r\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nlet suspUrlMsgs = MessageUrlInfo\r\n | where isnotempty(UrlDomain)\r\n | extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n | where Tld in (suspTlds)\r\n | distinct TeamsMessageId;\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| extend ConvType = case(isnotempty(GroupId), \"Channel\", array_length(todynamic(RecipientDetails)) > 1, \"Group chat\", \"1:1 chat\")\r\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\r\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\"1:1 chat\"), GroupChat=countif(ConvType==\"Group chat\"), ChannelMsgs=countif(ConvType==\"Channel\"), ThreatMessages=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\"), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\r\n| where ThreatMessages > 0\r\n| extend ThreatRatePct = round(100.0 * ThreatMessages / Messages, 1)\r\n| top 10 by ThreatMessages desc\r\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Threat Msgs']=ThreatMessages, Malware, Phish, Spam, ['Threat Rate %']=ThreatRatePct, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Threat Messages", "formatter": 3, "formatOptions": { "palette": "redDark" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "teams anomaly table", "id": "bcd6746d-8298-495d-9d6c-2fadc6cba569" }, { "type": 1, "content": { "json": "### Suspicious new senders (no threat verdict yet)
\r\n\r\n**External sending domains with no threat verdict yet, but that are either sending low-reputation-URL messages or showing unusual volume. These slip past threat filters - watch for new domains skewing toward 1:1 chats, an early social-engineering signal. Note: to exclude your own tenant domains, edit the query and uncomment the ExcludeDomains filter.**" }, "customWidth": "100", "name": "teams newdom header", "id": "9e3844f4-befc-4b76-a8cd-ca53fdf51d41" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query surfaces external sender domains in Microsoft Teams that have NO threat verdict yet but are sending messages with low-reputation URL TLDs or unusual volume, split by conversation type. These are early-warning senders that have not tripped a detection. Messages are de-duplicated to the latest record per message.\r\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\r\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nlet suspUrlMsgs = MessageUrlInfo\r\n | where isnotempty(UrlDomain)\r\n | extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n | where Tld in (suspTlds)\r\n | distinct TeamsMessageId;\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| extend ConvType = case(isnotempty(GroupId), \"Channel\", array_length(todynamic(RecipientDetails)) > 1, \"Group chat\", \"1:1 chat\")\r\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\r\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\"1:1 chat\"), GroupChat=countif(ConvType==\"Group chat\"), ChannelMsgs=countif(ConvType==\"Channel\"), ThreatMessages=countif(isnotempty(ThreatTypes)), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\r\n| where ThreatMessages == 0\r\n| where SuspUrlMsgs > 0 or Messages >= 5\r\n| order by SuspUrlMsgs desc, Messages desc\r\n| take 10\r\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true } }, "customWidth": "100", "name": "teams newdom table", "id": "8036a5b7-b5b3-4af4-912f-bb092bb01b89" }, { "type": 1, "content": { "json": "### Low-reputation link domains in Teams (IOC radar)
\r\n\r\n**URL domains shared in Teams that use TLDs commonly abused for phishing and malware (for example .xyz, .top, .click, .zip, .shop). Ranked by message reach, with first/last-seen. Review these domains as potential indicators - .zip and .mov are especially deceptive because links read like file names.**" }, "customWidth": "100", "name": "teams tld header", "id": "d48921f4-233c-4e0f-a97b-83e1bcaed399" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists URL domains shared in Microsoft Teams that use low-reputation TLDs commonly abused for phishing and malware, ranked by the number of Teams messages they appeared in, with first- and last-seen. Treat high-reach or newly-seen domains as candidate indicators of compromise.\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n| where Tld in (suspTlds)\r\n| summarize Messages=dcount(TeamsMessageId), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ['URL Domain']=UrlDomain, ['TLD']=Tld\r\n| top 10 by Messages desc", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "Messages", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] } }, "customWidth": "100", "name": "teams tld table", "id": "30d5588e-010c-474a-9c53-74b73dcc9676" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "14" }, "name": "group - Teams Targeted Users & Risky Senders", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "6fef737b-cb4e-4a51-9ced-bf11754a6b33" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Teams File Protection\r\n
\r\n\r\nMicrosoft Defender for Office 365 scans files shared in Microsoft Teams. These visuals show files scanned versus malware detected, and list the malicious files found.

**Recommended action:** Investigate each malicious file below and confirm it was quarantined and removed from the SharePoint or OneDrive location backing the chat. Enable Safe Attachments for SharePoint, OneDrive, and Microsoft Teams, and use attack surface reduction rules to block executable content delivered through collaboration." }, "name": "teams file banner", "id": "2f01c905-dd65-4a13-9f67-c70402b2c175" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query summarizes Microsoft Teams file protection by Microsoft Defender for Office 365 - files scanned, files with malware detected, and files scanned with no detection - for the selected period.\r\nlet base = FileMaliciousContentInfo | where Workload == \"MicrosoftTeams\";\r\nunion\r\n(base | summarize Count = count() | extend Details = \"Teams Files Scanned\", Ord = 1),\r\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files with Malware Detected\", Ord = 2),\r\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files Scanned - No Detection\", Ord = 3)\r\n| sort by Ord asc\r\n| project Count, Details", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full" } }, "customWidth": "100", "name": "teams file tiles", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "9f555c51-1680-47ef-94d4-b1f8cf9dce3b" }, { "type": 1, "content": { "json": "### Malicious files shared in Teams
\r\n\r\n**Files shared in Microsoft Teams that were detected with malware, with owner and file details.**" }, "customWidth": "100", "name": "teams file table header", "id": "4cd3274e-0c61-4722-83b7-1fccf8a94a57" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365 for the selected period.\r\nFileMaliciousContentInfo\r\n| where Workload == \"MicrosoftTeams\"\r\n| where isnotempty(ThreatTypes)\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['File Name']=FileName, ['Threat Type']=tostring(ThreatTypes), ['Threat Names']=ThreatNames, ['File Location']=FolderPath, ['File Owner']=FileOwnerUpn, SHA256", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true } }, "customWidth": "100", "name": "teams file table", "id": "135e0e7d-7110-40ee-a377-1a5992b2ef9d" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "14" }, "name": "group - Teams File Protection", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "8ecc1bae-4a06-4b1c-8952-59fb434b7cbc" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Post-Delivery ZAP Insights (Teams)\r\n
\r\n\r\nZero-hour auto purge (ZAP) removes malicious Microsoft Teams messages after delivery. These visuals summarize ZAP volume, type, result, and the senders whose messages were most often removed.

**Recommended action:** Confirm zero-hour auto purge is enabled for Microsoft Teams so newly-weaponized messages are pulled after delivery. Investigate senders with repeated ZAP removals as likely compromised or malicious accounts and block or restrict them. A rising ZAP trend can signal an active campaign that slipped past delivery-time filtering." }, "name": "teams zap banner", "id": "136cfb4e-d2a5-4db0-9771-6b6380011ba0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query summarizes Microsoft Teams post-delivery ZAP (zero-hour auto purge) activity by Microsoft Defender for Office 365 for the selected period.\r\nlet zap = materialize(MessagePostDeliveryEvents);\r\nunion\r\n(zap | summarize Count = count() | extend Details = \"Total ZAP Actions\", Ord = 1),\r\n(zap | where ActionType == \"Malware ZAP\" | summarize Count = count() | extend Details = \"Malware ZAP\", Ord = 2),\r\n(zap | where ActionType == \"Phish ZAP\" | summarize Count = count() | extend Details = \"Phish ZAP\", Ord = 3),\r\n(zap | where ActionResult == \"Success\" | summarize Count = count() | extend Details = \"Successful Actions\", Ord = 4),\r\n(zap | where ActionResult == \"Failed\" | summarize Count = count() | extend Details = \"Failed Actions\", Ord = 5),\r\n(zap | where Action == \"Moved to quarantine\" | summarize Count = count() | extend Details = \"Moved to Quarantine\", Ord = 6)\r\n| sort by Ord asc\r\n| project Count, Details", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full" } }, "customWidth": "100", "name": "teams zap tiles", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "06980411-5e6b-4aa4-a746-351cd2b12dae" }, { "type": 1, "content": { "json": "### ZAP actions over time
\r\n\r\n**Microsoft Teams post-delivery ZAP actions (per selected interval) split by Malware ZAP and Phish ZAP.**" }, "customWidth": "66", "name": "teams zap trend header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "7fc1cfcd-3a9f-45b1-9f39-3820fce23c03" }, { "type": 1, "content": { "json": "### ZAP by action type
\r\n\r\n**Distribution of Microsoft Teams post-delivery ZAP actions by type.**" }, "customWidth": "33", "name": "teams zap pie header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "9bc0d0a3-876a-49d7-9046-31764511ca38" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises Microsoft Teams post-delivery ZAP actions over time by ZAP type, summarizing the data per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(MessagePostDeliveryEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(MessagePostDeliveryEvents | summarize max(Timestamp));\r\nlet agg = materialize(MessagePostDeliveryEvents\r\n| summarize MalwareZAP = countif(ActionType == \"Malware ZAP\"), PhishZAP = countif(ActionType == \"Phish ZAP\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, MalwareZAP = coalesce(MalwareZAP, 0), PhishZAP = coalesce(PhishZAP, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "xAxis": "Timestamp" } }, "customWidth": "66", "name": "teams zap trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "c78a509e-324f-4a8c-b2e7-bce3e0d20667" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query shows Microsoft Teams post-delivery ZAP actions by type for the selected period.\r\nMessagePostDeliveryEvents\r\n| summarize Count = count() by ActionType", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "33", "name": "teams zap pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "cfc94695-fb02-4b6c-a223-f79f7b947379" }, { "type": 1, "content": { "json": "### Top senders whose messages were removed by ZAP
\r\n\r\n**Senders whose Microsoft Teams messages were most often removed by post-delivery ZAP.**" }, "customWidth": "100", "name": "teams zap senders header", "id": "f8677ffe-007a-41ca-81de-1ae5dd19d06a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists the top 10 senders whose Microsoft Teams messages were removed by post-delivery ZAP for the selected period.\r\nMessagePostDeliveryEvents\r\n| where isnotempty(SenderEmailAddress)\r\n| summarize ZapActions = count(), MalwareZAP = countif(ActionType == \"Malware ZAP\"), PhishZAP = countif(ActionType == \"Phish ZAP\") by SenderEmailAddress\r\n| top 10 by ZapActions\r\n| project ['Sender']=SenderEmailAddress, ['ZAP Actions']=ZapActions, ['Malware ZAP']=MalwareZAP, ['Phish ZAP']=PhishZAP", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ZAP Actions", "formatter": 3, "formatOptions": { "palette": "redDark" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "teams zap senders table", "id": "50c9a883-6442-40dc-b84f-57adfbb46a38" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "14" }, "name": "group - Teams ZAP", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "f5cc2425-e5ae-4520-9a97-2e4c2c447dcd" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Teams Message and Call Submissions\r\n
\r\n\r\nMicrosoft Teams messages and calls reported by users, and messages submitted by admins, for review by Microsoft. Sourced from the submission records in CloudAppEvents.

**Recommended action:** Encourage users to report suspicious Teams messages and calls so Microsoft can tune protection, and triage admin submissions promptly. A cluster of reports naming the same sender, display name, or call identity is an early signal of a targeted campaign: pivot those identities into the impersonation and risky-sender views above to scope it." }, "name": "teams sub banner", "id": "54cbfb29-2626-4b65-8cb5-a42ff4b41e63" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query summarizes Microsoft Teams message and call submissions reported to Microsoft for the selected period, split by user and admin reports. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\r\nlet sub = materialize(CloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType in (\"ChatMessage\", \"TeamsCall\"));\r\nunion\r\n(sub | where SubmissionContentType == \"ChatMessage\" and ActionType == \"UserSubmission\" | summarize Count = count() | extend Details = \"Messages Reported by Users\", Ord = 1),\r\n(sub | where SubmissionContentType == \"TeamsCall\" and ActionType == \"UserSubmission\" | summarize Count = count() | extend Details = \"Calls Reported by Users\", Ord = 2),\r\n(sub | where SubmissionContentType == \"ChatMessage\" and ActionType == \"AdminSubmission\" | summarize Count = count() | extend Details = \"Messages Submitted by Admins\", Ord = 3)\r\n| sort by Ord asc\r\n| project Count, Details", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "secondaryContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "showBorder": true, "size": "full" } }, "customWidth": "100", "name": "teams sub tiles", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "419ed645-ebc1-4df1-b9f0-c744403ab494" }, { "type": 1, "content": { "json": "### Submissions over time
\r\n\r\n**Microsoft Teams user and admin submissions (per selected interval).**" }, "customWidth": "66", "name": "teams sub trend header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "6a795b0a-82e2-427a-8ac0-abfb5bb5e447" }, { "type": 1, "content": { "json": "### Submission mix
\r\n\r\n**Microsoft Teams submissions split by content type (message or call) and reporter (user or admin).**" }, "customWidth": "33", "name": "teams sub pie header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "1f4c55f8-7290-4b6f-b02a-e3134568b9ff" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises Microsoft Teams message and call submissions over time, summarizing the data per selected interval. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\r\nlet gran = {Granularity};\r\nlet sub = materialize(CloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType in (\"ChatMessage\", \"TeamsCall\"));\r\nlet minTime = toscalar(sub | summarize min(Timestamp));\r\nlet maxTime = toscalar(sub | summarize max(Timestamp));\r\nlet agg = materialize(sub\r\n| summarize UserReports = countif(ActionType == \"UserSubmission\"), AdminReports = countif(ActionType == \"AdminSubmission\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, UserReports = coalesce(UserReports, 0), AdminReports = coalesce(AdminReports, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "xAxis": "Timestamp" } }, "customWidth": "66", "name": "teams sub trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "7dcb03da-de96-4388-90a4-0a3f3ca98dc6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query shows the mix of Microsoft Teams submissions by content type and reporter for the selected period. Only completed user submissions (chat and call) and admin submissions (chat) are counted; submission triage/timeout lifecycle records are excluded.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\"\r\n| where (SubmissionContentType == \"ChatMessage\" and ActionType == \"UserSubmission\")\r\n or (SubmissionContentType == \"TeamsCall\" and ActionType == \"UserSubmission\")\r\n or (SubmissionContentType == \"ChatMessage\" and ActionType == \"AdminSubmission\")\r\n| extend Reporter = iif(ActionType == \"AdminSubmission\", \"Admin\", \"User\")\r\n| summarize Count = count() by SubmissionType = strcat(SubmissionContentType, \" (\", Reporter, \")\")", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "33", "name": "teams sub pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "84a0141e-51de-4423-acb0-3c4342a49bf2" }, { "type": 1, "content": { "json": "### False Negative (FN) User Submissions by submission State
\r\n\r\n**Microsoft Teams messages reported by users as missed detections, broken down by submission state (for example Rescaned, Graded). Tracks the processing status of user reports.**" }, "customWidth": "50", "name": "teams sub state header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "1b2bdffd-69b0-41b0-bdda-b242b7faaec0" }, { "type": 1, "content": { "json": "### False Negative (FN) User Submissions by Triage Verdict
\r\n\r\n**Microsoft Teams user submissions grouped by the verdict assigned during grading (for example Phishing, NotSpam, Spam). Shows how reported messages were graded and highlights detection gaps.**" }, "customWidth": "50", "name": "teams sub verdict header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "bdb97e09-44d2-41ad-a99f-931e4a8169cc" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query shows Microsoft Teams user (false negative) message submissions by submission state (for example Rescaned, Graded), to track processing status.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend SubmissionState = tostring(RD.SubmissionState)\r\n| summarize Count = count() by tostring(SubmissionState)", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "teams sub state pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "139ce840-5fc2-44d1-9872-91b37a74f0e7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query shows Microsoft Teams user (false negative) message submissions by the triage verdict assigned during grading (for example Phishing, NotSpam, Spam).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend TriageVerdict = tostring(parse_json(tostring(RD.GradingResult)).TriageVerdict)\r\n| where isnotempty(TriageVerdict)\r\n| summarize Count = count() by TriageVerdict", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "teams sub verdict pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "538ce4a3-a1ff-4b8d-a466-2173edbb2cd7" }, { "type": 1, "content": { "json": "### Top 10 P2 sender domains in FN User Submissions
\r\n\r\n**The sender domains most often reported by users as missed Microsoft Teams threats. High-volume domains are candidate sources of malicious messaging.**" }, "customWidth": "50", "name": "teams sub domains header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "9b8db0c7-2bf2-4077-ae20-60146001bf23" }, { "type": 1, "content": { "json": "### Top 10 individual P2 senders in FN User Submissions
\r\n\r\n**The individual senders most often reported by users as missed Microsoft Teams threats.**" }, "customWidth": "50", "name": "teams sub senders header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "ffbe90ab-129c-47fa-9dac-50cab528ad55" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists the top 10 P2 (envelope) sender domains of Microsoft Teams messages reported by users as false negatives (missed detections).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend P2SenderDomain = tostring(RD.P2SenderDomain)\r\n| where isnotempty(P2SenderDomain)\r\n| summarize Submissions = count() by ['P2 Sender Domain']=P2SenderDomain\r\n| top 10 by Submissions", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "Submissions", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] } }, "customWidth": "50", "name": "teams sub domains table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "b18192fb-26a8-4bd1-9b07-7aeab496eae3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists the top 10 individual P2 (envelope) senders of Microsoft Teams messages reported by users as false negatives (missed detections).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend P2Sender = tostring(RD.P2Sender)\r\n| where isnotempty(P2Sender)\r\n| summarize Submissions = count() by ['P2 Sender']=P2Sender\r\n| top 10 by Submissions", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "Submissions", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] } }, "customWidth": "50", "name": "teams sub senders table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "7ead0a01-2b56-4225-b625-554b09350013" }, { "type": 1, "content": { "json": "### Top 10 users performing the most FN User Submissions
\r\n\r\n**The users who report the most Microsoft Teams messages as missed detections - useful for recognising engaged reporters and spotting over-reporting.**" }, "customWidth": "50", "name": "teams sub topusers header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "fb893cdd-d6d3-431a-a1d2-87652571a10d" }, { "type": 1, "content": { "json": "### Top 10 admins performing the most FN Admin Submissions
\r\n\r\n**The admins who submit the most Microsoft Teams messages as missed detections.**" }, "customWidth": "50", "name": "teams sub topadmins header", "styleSettings": { "margin": "10px", "padding": "0px" }, "id": "14fca69b-e152-4a5d-bd2c-020c34c2226a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists the top 10 users who reported the most Microsoft Teams messages as false negatives (missed detections), with each submitter's email (from the submission record) to disambiguate users with similar names.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterEmail = tostring(RD.UserId)\r\n| where isnotempty(Submitter) and SubmitterEmail has \"@\"\r\n| summarize Submissions = count() by ['Submitter']=Submitter, ['Email']=SubmitterEmail\r\n| top 10 by Submissions", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true } }, "customWidth": "50", "name": "teams sub topusers table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "a171a35b-35b0-46ce-a916-052a54101126" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists the top 10 admins who submitted the most Microsoft Teams messages as false negatives (missed detections). The admin's own email is not present in the submission record (that would require the Identity table), so the Submitter ID (object GUID) is shown to disambiguate admins with similar names.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"AdminSubmission\"\r\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterId = tostring(RD.SubmitterId)\r\n| where isnotempty(Submitter)\r\n| summarize Submissions = count() by ['Admin']=Submitter, ['Submitter ID']=SubmitterId\r\n| top 10 by Submissions", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true } }, "customWidth": "50", "name": "teams sub topadmins table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "8bf37c2b-067a-4341-a192-2aa45699c3f7" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "14" }, "name": "group - Teams Submissions", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "eeea53a4-69d9-426e-bf9f-1789cd73bfed" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Recent Threat Detail\r\n
\r\n\r\nThe most recent Microsoft Teams phishing and malware messages, de-duplicated to the latest record per message, for investigation." }, "name": "teams detail banner", "id": "4bdd917c-721f-450b-b455-45cbd5f59cc5" }, { "type": 1, "content": { "json": "### Last 10 Teams phishing messages
\r\n\r\n**Most recent Microsoft Teams messages detected as phishing, with sender, delivery action, safety tip, team/group, and subject. TeamsMessageId is included to pivot to Advanced Hunting.**" }, "customWidth": "100", "name": "teams detail phish header", "id": "9bcf96c1-a958-4515-b171-10ec2f3ba660" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true } }, "customWidth": "100", "name": "teams detail phish table", "id": "3675d08f-1165-4f47-a633-e432cf96e3d5" }, { "type": 1, "content": { "json": "### Last 10 Teams malware messages
\r\n\r\n**Most recent Microsoft Teams messages detected as malware, with sender, delivery action, safety tip, team/group, and subject. TeamsMessageId is included to pivot to Advanced Hunting.**" }, "customWidth": "100", "name": "teams detail mal header", "id": "6b9d66d2-8d89-47b0-a72a-5ee8623082dc" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true } }, "customWidth": "100", "name": "teams detail mal table", "id": "d6e76d0a-7eee-4c05-8e92-10f9622b5ab3" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "14" }, "name": "group - Teams Detail", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "1e9c879b-d6be-4d36-9068-b5438abf7dd2" }, { "type": 1, "content": { "json": "# Top Attacked Users, Top Senders, and Automatic External Email Forwarding\r\n\r\n---\r\nThis tab provides insights into **Top attacked users, Top Senders** in inbound email messages and details about **automatic external email forwarding**." }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "6" }, "name": "text - 24 - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "f1a60054-44b1-432e-be7a-9d7d114ff5c7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Top Attacked Users and Top Senders Insights\r\n
\r\n\r\nThis section provides key visuals that highlight top attacked users – individuals most frequently targeted by inbound email threats as detected by Microsoft Defender for Office 365. Offers insights into top email senders and sender domains across inbound email traffic, helping identify patterns and potential risk sources.

**Recommended action:** Apply the Strict preset to the most-attacked users and review the top sender domains as possible block-list candidates." }, "name": "text - 13 - Copy - Copy", "id": "ff220902-30b8-4aef-9b79-14c913a1b2d2" }, { "type": 1, "content": { "json": "### Top Attacked Users
\r\n\r\n**Displays the top 10 recipient email addresses that received inbound emails flagged as Spam, Phishing, or Malware. Helps identify high-risk users for targeted security awareness and policy enforcement.**" }, "name": "text - 13 - Copy - Copy - Copy", "id": "58f34b9f-824d-4fcf-b2aa-d7d380aa08d5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// This query visualises the top 10 users that are receiving Spam, Phishing or Malware emails\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection == \"Phish\"),SpamEmailCount = countif(FirstDetection == \"Spam\") by RecipientEmailAddress\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by ThreatEmailCount\r\n| project ['Recipient']=RecipientEmailAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Total Emails", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Threat Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Malware", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Phish", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Spam", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad Traffic %", "formatter": 4, "numberFormat": { "unit": 1, "options": { "style": "decimal" } }, "formatOptions": { "palette": "red", "min": 0, "max": 20 } } ], "filter": true, "sortBy": [ { "itemKey": "$gen_bar_Threat Emails_2", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_bar_Threat Emails_2", "sortOrder": 2 } ], "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "100", "name": "query - 28", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "e9459e78-6b43-4ef2-9596-32169d95c610" }, { "type": 1, "content": { "json": "### Top 10 Senders of Inbound Emails
\r\n\r\n**Displays the top 10 sender email addresses from external sources delivering inbound emails. Helps identify high-volume external senders for monitoring and policy enforcement.**" }, "name": "text - 13 - Copy - Copy - Copy - Copy", "id": "eb4590a7-57c7-4728-af62-3d798afe6f2d" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// This query visualises the top 10 senders by inbound email sending volume\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection == \"Phish\"),SpamEmailCount = countif(FirstDetection == \"Spam\") by SenderFromAddress\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by TotalEmailCount\r\n| project ['Sender']=SenderFromAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Total Emails", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Threat Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Malware", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Phish", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Spam", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad Traffic %", "formatter": 4, "numberFormat": { "unit": 1, "options": { "style": "decimal" } }, "formatOptions": { "palette": "red", "min": 0, "max": 20 } } ], "filter": true }, "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "100", "name": "query - 28 - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "e4272979-1073-4c1e-9b1b-b971bc3efc33" }, { "type": 1, "content": { "json": "### Top 10 Sender Domains of Inbound Emails
\r\n\r\n**Displays the top 10 sender domains from external sources delivering inbound emails. Helps identify high-volume external sender domains for monitoring and policy enforcement.**" }, "name": "text - 13 - Copy - Copy - Copy - Copy - Copy", "id": "7ab63415-17ce-47f1-a614-e5e6edbe472e" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// This query visualises the top 10 senders by inbound email sending volume\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection == \"Phish\"),SpamEmailCount = countif(FirstDetection == \"Spam\") by SenderFromDomain\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by TotalEmailCount\r\n| project ['Sender Domain']=SenderFromDomain, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Total Emails", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Threat Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Malware", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Phish", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Spam", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Bad Traffic %", "formatter": 4, "numberFormat": { "unit": 1, "options": { "style": "decimal" } }, "formatOptions": { "palette": "red", "min": 0, "max": 20 } } ], "filter": true }, "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "100", "name": "query - 28 - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "b593da94-b735-4fe3-a82d-18c90156e506" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "6" }, "name": "group - 10-Top attacked users and top senders", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "3e41cc1a-166e-4094-bc66-7e26a918b2e9" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Automatic External Email Forwarding Insights\r\n
\r\n\r\n**Email forwarding can be useful, but can also pose a security risk due to the potential disclosure of information.**\r\n
\r\n\r\nUsers can configure [Inbox rules](https://support.microsoft.com/en-US/Outlook/mail/use-rules-to-automatically-forward-messages) in Outlook or set up [SMTP forwarding](https://support.microsoft.com/en-us/office/turn-on-automatic-forwarding-in-outlook-7f2670a1-7fff-4475-8a3c-5822d63b0c8e) to automatically forward messages to external recipients. You can control automatic external email forwarding from cloud mailboxes using [Outbound spam policies](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding) in Microsoft Defender for Office 365. \r\n**Attackers might exploit this capability to compromise your organization or its partners.**

**Recommended action:** Investigate external auto-forwarding - it is a common data-exfiltration path. Consider disabling auto-forwarding via the outbound spam policy unless a business case is documented." }, "name": "text - 8", "id": "b04d1590-98e3-4650-9172-33e75561e1e5" }, { "type": 1, "content": { "json": "### Automatic Email Forwarding by Type
\r\n\r\n**Displays counts of outbound emails automatically forwarded to external addresses, grouped by forwarding type (e.g., SMTP forwarding, inbox rules). Helps identify forwarding behaviors that may pose data exfiltration risks.**" }, "customWidth": "50", "name": "text - 13 - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "c7cb7917-eaf4-4a1e-989a-75f4b6182851" }, { "type": 1, "content": { "json": "### Top 10 Internal Users Forwarding Emails Externally
\r\n\r\n**Displays the top 10 internal user accounts that have automatically forwarded emails to external addresses (regardless of the forwarding type used). Helps identify potential data exfiltration risks and enforce forwarding policies.**" }, "customWidth": "50", "name": "text - 13 - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "5a5d5a8c-c195-45db-a878-e6ac908cc919" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// This query visualises automatic email forwarding to external email addresses by forwarding type\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| summarize count() by ForwardingType\r\n| sort by count_ desc \r\n", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "chartSettings": { "yAxis": [ "count_" ], "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 30 - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "15094d98-add2-4b50-a0df-ee91fd34c6fb" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| summarize TotalForwardedMessages = count() by ForwardingUser\r\n| sort by TotalForwardedMessages desc \r\n| top 10 by TotalForwardedMessages\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages\r\n\r\n", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Forwarded Messages", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "chartSettings": { "yAxis": [ "TotalForwardedMessages" ] } }, "customWidth": "50", "name": "query - 30 - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "73d66038-2ea0-449d-9aeb-a1bd4b207d7f" }, { "type": 1, "content": { "json": "### Top 10 Internal Users Forwarding Emails Using Mailbox Rules
\r\n\r\n**Displays the top 10 internal user accounts that have automatically forwarded outbound emails to external addresses using Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**" }, "customWidth": "100", "name": "text - 13 - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "9a7b5fc3-da23-4e95-87df-542a5e3f6320" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by ForwardingUser\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Forwarded Messages", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "chartSettings": { "yAxis": [ "TotalForwardedMessages" ] } }, "customWidth": "100", "name": "query - 30 - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "f8d7b85d-944a-493f-a143-7e18277846c9" }, { "type": 1, "content": { "json": "### Top 10 External domains Receiving Auto-Forwarded Emails (Mailbox Rules)
\r\n\r\n**Displays the top 10 external recipient email domains that received automatically forwarded emails from internal users via Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**" }, "customWidth": "50", "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "cda99a50-b7c4-4d95-ac61-7231080a3f5d" }, { "type": 1, "content": { "json": "### Top 10 External Recipients Receiving Auto-Forwarded Emails (Mailbox Rules)
\r\n\r\n**Displays the top 10 external recipient email addresses that received automatically forwarded emails from internal users via Mailbox Rules. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**" }, "customWidth": "50", "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "72b01575-c33e-457c-98db-ea755c003bf0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// This query visualises the top 10 external domains who are recieving automatically forwarded emails using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by RecipientDomain\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Forwarded Messages", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "chartSettings": { "yAxis": [ "count_" ], "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 30 - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "823dec28-48b5-4be3-8e68-04301a952a62" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Forwarded Messages", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "chartSettings": { "yAxis": [ "count_" ], "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 30 - Copy - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "14804990-bfc9-43b7-8c8d-95c2cf32ee56" }, { "type": 1, "content": { "json": "### Top 10 Internal Users Forwarding Emails via SMTP Forwarding
\r\n\r\n**Displays the top 10 internal user accounts that have automatically forwarded outbound emails to external addresses using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**" }, "customWidth": "100", "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "fa04b313-5756-4ff7-9ee8-ec61e6b382cc" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize count() by ForwardingUser\r\n| top 10 by count_ desc\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=count_", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "chartSettings": { "yAxis": [ "count_" ], "createOtherGroup": 10 }, "gridSettings": { "formatters": [ { "columnMatch": "Forwarded Messages", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "query - 30 - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "bed8e717-4ea7-4f71-aaa7-b70a31f4dc88" }, { "type": 1, "content": { "json": "### Top 10 External domains receiving Auto-Forwarded Emails (SMTP Forwarding)
\r\n\r\n**Displays the top 10 external recipient email domains that received automatically forwarded emails from internal users using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**" }, "customWidth": "50", "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "f76bc717-3cf8-4d8d-92fa-3f2024065f8f" }, { "type": 1, "content": { "json": "### Top 10 External Recipients Receiving Auto-Forwarded Emails (SMTP Forwarding)
\r\n\r\n**Displays the top 10 external recipient email addresses that received automatically forwarded emails from internal users using SMTP Forwarding. Helps identify potential data exfiltration risks and enforce forwarding restrictions.**" }, "customWidth": "50", "name": "text - 13 - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "2190c799-ab4f-4bd8-87e1-f9c5c224cca4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize TotalForwardedMessages = count() by RecipientDomain\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Forwarded Messages", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "chartSettings": { "yAxis": [ "count_" ], "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 30 - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "c3be87b3-8ce8-40f2-ad92-0651bed71117" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Forwarded Messages", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true }, "chartSettings": { "yAxis": [ "count_" ], "createOtherGroup": 10 } }, "customWidth": "50", "name": "query - 30 - Copy - Copy - Copy - Copy - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "fb6b0113-f5bb-46a7-994b-92ebc3c7881d" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "6" }, "name": "group - 34 - Automatic email forwarding", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "02c91ebb-4f92-4843-a73b-6dea7a6ac2bd" }, { "type": 1, "content": { "json": "# Email detection action overrides\r\n\r\n---\r\n\r\nThis tab provides insights into admin or end-user configured **detection overrides** where the message was detected as a threat by Microsoft Defender for Office 365, however an admin-configured policy or end-user setting overrode the detection action.[

Learn more

](https://learn.microsoft.com/en-us/defender-office-365/step-by-step-guides/understand-overrides-in-email-entity) " }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "7" }, "name": "text - 13 - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "ae594968-00b9-40b8-b5dd-052a27440afb" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Admin configured Detection Overrides (Allow)\r\n
\r\n\r\nThis section consolidates key visuals that track emails subject to administrator policies (e.g., Transport Rules, Tenant Allow/Block List) with an \"Allow\" action, overriding Microsoft Defender for Office 365 detections (excluding SecOps Mailbox overrides).

**Recommended action:** Review Allow overrides that later carried threats and remove stale or overly broad allow entries - they weaken protection." }, "name": "text - AdminOverridesAllowHeader", "id": "3d70a304-c590-4156-a6d4-da147fe106ab" }, { "type": 1, "content": { "json": "### Admin Overrides (Allow) Trend\r\n**Displays the count (per {Granularity}) of emails where an administrator policy with an \"Allow\" action overrode detections (excluding SecOps Mailbox). Helps track the frequency of admin overrides over time.**" }, "name": "text - AdminOverridesAllowTrend", "id": "a4ee104a-a0a1-4725-a60f-deedcc91af70" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the ammount of emails subject to an admin policy with action of allow independent of action taken, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Admin Overrides", "color": "blueDark" } ] } }, "name": "query - 3", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "79928e9e-48ed-4d08-8ff7-c21fe027550e" }, { "type": 1, "content": { "json": "### Total Emails by Admin Override type (Allow)\r\n**Summarizes the total count of emails subject to administrator policies with an \"Allow\" action, grouped by the type of override. Helps identify which policies are most frequently allowing emails.**" }, "customWidth": "50", "name": "text - AdminOverridesAllowByType", "id": "855fce09-2000-4d16-8521-8b4eeddfae00" }, { "type": 1, "content": { "json": "### Admin Overrides (Allow) by Override Type and Threat Type\r\n**Details the count of emails allowed by administrator policies, categorized by the override type and the detected threat type. Helps assess the risk associated with allowed emails.**" }, "customWidth": "50", "name": "text - AdminOverridesAllowByTypeAndThreat", "id": "a2613078-b427-4b23-aca0-21989b1944db" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "query - 16", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "b21a0329-8f52-45c2-81f2-6df65c134673" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Total Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ] } }, "customWidth": "50", "name": "query - 2", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "0bf4cbe6-7c84-49d4-801c-d955762b5699" }, { "type": 1, "content": { "json": "### SecOps Mailbox Overrides (Allow)\r\nThis section focuses on emails allowed specifically due to the SecOps Mailbox override policy, typically used for investigation and analysis.[

Learn more

](https://learn.microsoft.com/en-us/defender-office-365/advanced-delivery-policy-configure) " }, "name": "text - SecOpsOverridesHeader", "id": "f582dc86-4c40-4cdd-ba0b-ec6ef8820a27" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of emails subject to the \r\nEmailEvents \r\n| where OrgLevelPolicy==\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "stat", "statSettings": { "valueAggregation": "None", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed", "thresholdsGrid": [] }, "iconSettings": { "thresholdsGrid": [] }, "tagText": "", "valueFontStyle": "auto", "tagTextPosition": "bottom" } }, "customWidth": "50", "name": "query - 1", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "8ad2fea4-dcd0-454e-a4d4-b5275c86fd9b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the ammount of emails delivered to the SecOps Mailbox by threat type\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy==\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails", "size": 1, "showAnalytics": true, "title": " ", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Total Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ] } }, "customWidth": "50", "name": "query - 4", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "52c04df2-69b5-46e4-a000-7c6d212a132a" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "7" }, "name": "group - 15 - Admin Detection Overrides - Allow", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "9b9baf2f-fd5f-41b6-8368-b515f8de4fd4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Admin configured Detection Overrides (Block)\r\n
\r\n\r\nThis section provides insights into email messages blocked by administrative policies (e.g. Tenant allow/block list, Antimalware policy file type block), overriding detection actions defined by Microsoft Defender for Office 365.

**Recommended action:** Confirm these blocks are still needed and consolidate them into the Tenant Allow/Block List where appropriate." }, "name": "text - AdminOverridesBlockHeader", "id": "6157683b-cce7-4165-886f-0da73e25ce86" }, { "type": 1, "content": { "json": "### Admin Overrides (Block) Trend\r\n**Displays the count (per {Granularity}) of emails where an administrator policy with a \"Block\" action overrode detections. Helps track the frequency of admin blocks over time.**" }, "name": "text - AdminOverridesBlockTrend", "id": "699820b4-a984-45cc-ab2f-607c3c8569d4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Admin Overrides", "color": "blueDark" } ] } }, "customWidth": "100", "name": "query - 5", "styleSettings": { "margin": "10", "padding": "10" }, "id": "9ef5e7fb-843e-439b-b4f3-9b0bb149e74b" }, { "type": 1, "content": { "json": "### Total Emails by Admin Override Type (Block)\r\n**Summarizes the total count of emails subject to administrator policies with a \"Block\" action, grouped by the type of override.**" }, "customWidth": "50", "name": "text - AdminOverridesBlockByType", "id": "5694a7c0-1ee5-40b4-ae2b-263d189c4b4e" }, { "type": 1, "content": { "json": "### Admin Overrides (Block) by Override Type and Threat Type\r\n**Details the count of emails blocked by administrator policies, categorized by the override type and the detected threat type.**" }, "customWidth": "50", "name": "text - AdminOverridesBlockByTypeAndThreat", "id": "6e309742-37c0-4ad5-9b9a-63643059bfaf" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of emails subject to an admin policy with action of block, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "query - 6", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "eabc80ed-d0e9-43d2-ab13-a5af478f11c8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Total Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ] } }, "customWidth": "50", "name": "query - 7", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "1661bfa6-d8fd-4387-a334-1bc027a3f6d1" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "7" }, "name": "group - 36-Admin Detection Overrides - Block", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "7d514e9a-f67f-45a6-ba1b-6492348cc18b" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
User configured Detection Overrides (Allow)\r\n
\r\n\r\nThis section consolidates key visuals that track email messages subject to user policies (e.g. [Safe Senders list defined in Outlook](https://learn.microsoft.com/en-us/defender-office-365/create-safe-sender-lists-in-office-365#use-outlook-safe-senders)) with an \"Allow\" action, overriding Microsoft Defender for Office 365 detections.

**Recommended action:** Educate users that safe-sender allows can bypass protection; review high-risk user allow entries." }, "name": "text - UserOverridesAllowHeader", "id": "4d41c560-0e73-40c5-b610-33e9500e88c4" }, { "type": 1, "content": { "json": "### User Overrides (Allow) Trend\r\n**Displays the count (per {Granularity}) of emails where a user policy with an \"Allow\" action overrode detections. Helps track the frequency of user overrides over time.**" }, "name": "text - UserOverridesAllowTrend", "id": "9432efff-9f03-4d74-8781-02be8b2d07fa" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "User Overrides", "color": "blueDark" } ] } }, "name": "query - 3", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "02da1d33-e477-479d-bdd3-95ab1ad7c75c" }, { "type": 1, "content": { "json": "### Total Emails by User Override Type (Allow)\r\n**Summarizes the total count of emails subject to user policies with an \"Allow\" action, grouped by the type of override.**" }, "customWidth": "50", "name": "text - UserOverridesAllowByType", "id": "006a2e87-b1b6-4cc3-a763-ceebaa86b340" }, { "type": 1, "content": { "json": "### User Overrides (Allow) by Override Type and Threat Type\r\n**Details the count of emails allowed by user policies, categorized by the override type and the detected threat type. Helps assess the risk associated with user-allowed emails.**" }, "customWidth": "50", "name": "text - UserOverridesAllowByTypeAndThreat", "id": "7c34bb4b-46c0-4054-9596-3dfd010bb036" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by UserLevelPolicy", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "query - 16", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "d1d9021d-e6bf-47b1-bdd2-438a212d2767" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Total Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ] }, "sortBy": [] }, "customWidth": "50", "name": "query - 2", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "1acd913c-c945-4a58-b04e-d008ca53ffe3" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "7" }, "name": "group - 15 - User Detection Overrides - Allow", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "c939060e-6a8b-49ff-951b-a3abddbd9fb4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
User configured Detection Overrides (Block)\r\n
\r\n\r\nThis section provides insights into emails blocked by user-configured policies (e.g., [Blocked Senders list in Outlook](https://support.microsoft.com/en-us/office/block-or-unblock-senders-in-outlook-9bf812d4-6995-4d19-901a-76d6e26939b0)).

**Recommended action:** Use user block trends to identify unwanted senders that may warrant tenant-wide blocking." }, "name": "text - UserOverridesBlockHeader", "id": "be6c6a3e-08ee-47c5-b8e7-6a1078dd17d1" }, { "type": 1, "content": { "json": "### User Overrides (Block) Trend\r\n**Displays the count (per {Granularity}) of emails where a user policy with a \"Block\" action overrode detections. Helps track the frequency of user blocks over time.**" }, "name": "text - UserOverridesBlockTrend", "id": "7cd77d54-2e2b-4d23-a6a9-4bd6bca2642a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "User Overrides", "color": "blueDark" } ] } }, "customWidth": "100", "name": "query - 5", "styleSettings": { "margin": "10", "padding": "10" }, "id": "0b21b66c-001d-4b3d-b47f-f3a420ccaaf8" }, { "type": 1, "content": { "json": "### Total Emails by User Override Type (Block)\r\n**Summarizes the total count of emails subject to user policies with a \"Block\" action, grouped by the type of override.**" }, "customWidth": "50", "name": "text - UserOverridesBlockByType", "id": "fd513501-5e9d-45d9-9d0d-cd546002b8cf" }, { "type": 1, "content": { "json": "### User Overrides (Block) by Override Type and Threat Type\r\n**Details the count of emails blocked by user policies, categorized by the override type and the detected threat type.**" }, "customWidth": "50", "name": "text - UserOverridesBlockByTypeAndThreat", "id": "4fbfa876-47ed-4c3b-81ee-1c40b982cecd" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of emails subject to a user type policy with action of block, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by UserLevelPolicy", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "query - 6", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "d3fccaa6-80fd-419d-bb37-aedf67263419" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Total Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ] } }, "customWidth": "50", "name": "query - 7", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "e5e74ce1-fa67-45ea-bc80-97237342e370" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "7" }, "name": "group - 37-User Detection Overrides - Block", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "0c1d327a-c2f1-4b9b-b210-53c808b53b48" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
User & Sender Override Detail (Allow)\r\n
\r\n\r\nInbound messages that Microsoft Defender for Office 365 **detected as threats but delivered anyway** because of an admin- or user-configured **Allow** override (phishing-simulation and SecOps Mailbox traffic excluded). **Total Threats** is all detected threats to that recipient / sender domain in the selected range; **Overridden Threats** and **Override %** are the portion delivered due to an Allow override, and **Override Types** names the specific overrides responsible. **User-configured** overrides come from the recipient's own mailbox junk-email settings in Outlook / Outlook on the web (the mailbox \"safelist collection\") — the **Safe Senders** and **Safe Recipients** lists and **trusted contacts** (\"Also trust email from my Contacts\"). **Admin-configured** overrides come from the **Tenant Allow/Block List, Exchange mail flow (transport) rules, the IP Allow List, or allowed sender/domain lists in anti-spam policies**. Use this to spot users or domains where overrides are letting threats through — candidates for policy review or a Tenant Allow/Block List (TABL) block.

**Recommended action:** Focus on the users and sender domains with the most allow overrides - these are the biggest protection gaps." }, "name": "Overrides - User Detail Header", "id": "3b0e83f3-f340-4b95-85c5-831783e8abc2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Top recipients receiving threats that were delivered due to an admin or user override, with the share of their threats that were overridden and a breakdown of which override types caused them.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend OverrideType = case(\r\n OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\r\n UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\r\n \"(none)\")\r\n| summarize PerType = count() by RecipientEmailAddress, OverrideType\r\n| summarize TotalThreats = sum(PerType),\r\n OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\r\n OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\r\n by RecipientEmailAddress\r\n| where OverriddenThreats > 0\r\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\r\n| top 15 by OverriddenThreats\r\n| project ['Recipient']=RecipientEmailAddress, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Overridden Threats", "formatter": 3, "formatOptions": { "palette": "redDark" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Override %", "formatter": 4, "formatOptions": { "palette": "red", "min": 0, "max": 20 }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ] }, "graphSettings": { "type": 2, "topContent": { "columnMatch": "StatisticName", "formatter": 1 }, "centerContent": { "columnMatch": "Value", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "StatisticName", "sourceIdField": "Value", "targetIdField": "Value", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5, "edgeColorSettings": null } }, "name": "Overrides - Top Users", "id": "d7e169a2-808a-4bbf-86ee-5be561c690f7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Top sender domains sending threats to users, with the share of those threats that were delivered because of an admin or user override and a breakdown of which override types caused them. High override rates are strong candidates for policy review or a Tenant Allow/Block List (TABL) block.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend OverrideType = case(\r\n OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\r\n UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\r\n \"(none)\")\r\n| summarize PerType = count() by SenderFromDomain, OverrideType\r\n| summarize TotalThreats = sum(PerType),\r\n OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\r\n OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\r\n by SenderFromDomain\r\n| where OverriddenThreats > 0\r\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\r\n| top 10 by OverriddenThreats\r\n| project ['Sender Domain']=SenderFromDomain, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Overridden Threats", "formatter": 3, "formatOptions": { "palette": "redDark" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Override %", "formatter": 4, "formatOptions": { "palette": "red", "min": 0, "max": 20 }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ] }, "graphSettings": { "type": 2, "topContent": { "columnMatch": "StatisticName", "formatter": 1 }, "centerContent": { "columnMatch": "Value", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } }, "nodeIdField": "StatisticName", "sourceIdField": "Value", "targetIdField": "Value", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5, "edgeColorSettings": null } }, "name": "Overrides - Top Sender Domains", "id": "0eda3153-10ea-4d4e-80ca-7e5ad99e9883" } ] }, "customWidth": "100", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "7" }, "name": "Overrides - User & Sender Detail", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "d5f38e54-a3c7-4df6-b569-bbabe85e1a36" }, { "type": 1, "content": { "json": "# False Negative(FN) Submissions insights\r\n\r\n---\r\n\r\nThis tab provides insights into email message **False Negative(FN) Submissions** performed by users or administrators in Microsoft Defender for Office 365 where the message reported to have **Malware, Phish or Spam threat** within its **content, URLs or attachments**." }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "8" }, "name": "text - 13 - Copy", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "3b243dca-89ce-41e6-bccb-9ceb0953aa2e" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
False Negative(FN) Admin submissions\r\n
\r\n\r\nThis section provides insights into email message **False Negative(FN) Submissions performed by administrators** in Microsoft Defender for Office 365 where the message reported to have Malware, Phish or Spam threat within its content, URLs or attachments.

**Recommended action:** Prioritise admin-submitted misses for policy tuning; recurring sender domains may be block-list candidates." }, "name": "fn admin - section header", "id": "64420254-0dae-4495-bd55-fc49e5bc1ed0" }, { "type": 1, "content": { "json": "### False Negative(FN) Admin Submissions per-{Granularity} trend by submission types \r\n**Displays counts (per {Granularity}) of False Negative(FN) Admin Submissions grouped by submission type (Spam, Phish, Malware) and content type (Mail, URL, Attachment). Helps to monitor where detections were missed and later submitted by admins as false negatives to Microsoft.**" }, "name": "fn admin - trend heading", "id": "5f2de929-6f32-4079-a031-cbf689c15b29" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the daily ammount of admin false negative submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize Admin_Malware_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Phish_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Spam_FN=countif(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Malware_URL_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Malware_Attach_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\"), Admin_Phish_URL_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Phish_Attach_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Malware (Mail)']=coalesce(Admin_Malware_FN,0), ['Phish (Mail)']=coalesce(Admin_Phish_FN,0), ['Spam (Mail)']=coalesce(Admin_Spam_FN,0), ['Malware (URL)']=coalesce(Admin_Malware_URL_FN,0), ['Malware (Attachment)']=coalesce(Admin_Malware_Attach_FN,0), ['Phish (URL)']=coalesce(Admin_Phish_URL_FN,0), ['Phish (Attachment)']=coalesce(Admin_Phish_Attach_FN,0) | sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "TotalAdminSubmissions", "color": "redDark" }, { "seriesName": "Phish (Mail)", "color": "redBright" }, { "seriesName": "Spam (Mail)", "color": "orange" }, { "seriesName": "Malware (Mail)", "color": "redDark" }, { "seriesName": "Phish (URL)", "color": "purple" }, { "seriesName": "Malware (Attachment)", "color": "yellowDark" }, { "seriesName": "Phish (Attachment)", "color": "purpleDark" }, { "seriesName": "Malware (URL)", "color": "yellow" } ] } }, "name": "fn admin - submissions trend", "id": "1b61155b-92a1-4533-9561-2e85e9a4dbf8" }, { "type": 1, "content": { "json": "### False Negative(FN) Admin Submissions by submission types \r\n**Displays counts (per {Granularity}) of False Negative(FN) Admin Submissions grouped by submission type (Spam, Phish, Malware) and content type (Mail, URL, Attachment).**" }, "customWidth": "50", "name": "fn admin - by-type heading", "id": "bbaa9ff9-a95d-495a-a44c-6b4cae888a24" }, { "type": 1, "content": { "json": "### False Negative(FN) Admin Submissions by submission State\r\n**Displays the total count of False Negative(FN) Admin Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of admin submissions and identify bottlenecks or errors.**" }, "customWidth": "50", "name": "fn admin - by-state heading", "id": "b060c706-342a-4b2e-b81a-920bf4d8c5d9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of admin false negative submission by submission type.\r\nCloudAppEvents \r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Malware (Mail)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Malware (URL)\",\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Malware (Attachment)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Phish (URL)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Phish (Attachment)\",\r\n\"Other\")))))))\r\n| where Admin_SubmissionType!=\"Other\"\r\n| summarize count() by Admin_SubmissionType", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "50", "name": "fn admin - by-type pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "9d9d714a-357b-4ac3-bcb7-33601d3c3108" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of admin false negative submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\r\n| summarize count() by tostring(SubmissionState)", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "fn admin - by-state pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "169f0f1c-1f1e-44fb-965e-850733f01879" }, { "type": 1, "content": { "json": "### False Negative(FN)/False Positive(FP) Admin Submissions by Triage Verdict\r\n**Displays the total count of False Negative(FN)/False Positive(FP) Admin Submissions grouped by TriageVerdict (e.g., Malware, Spam, Phish, Clean). Helps assess how submissions were graded during triage and identify detection gaps.**" }, "customWidth": "50", "name": "fn admin - triage-verdict heading", "id": "3df841be-c1b0-4d61-8e38-316a34a48bd1" }, { "type": 1, "content": { "json": "### Top Admins Submitting False Negatives \r\n**Displays the top 15 admin accounts that submitted the highest number of false negative messages (missed detections) via AdminSubmission. Helps identify key contributors to threat remediation and potential patterns in detection gaps.**" }, "customWidth": "50", "name": "fn admin - top-admins heading", "id": "e1e966f4-1f4d-4377-97c6-e2077fc0b8fa" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of admin false negative or false positive submissions by the verdict of the submission grading.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmissionTriage\" \r\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState, SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \r\n| summarize count() by tostring(TriageVerdict)", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "fn admin - triage-verdict pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "6df0db72-f9db-444e-856a-4369921d199b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the top admins performing false negative submissions\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType \r\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\r\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "16ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "50", "name": "fn admin - top-admins pie", "id": "b5ccb4a1-9783-47cf-bf21-ded924f1a200" }, { "type": 1, "content": { "json": "### False Negative(FN) Admin Submissions by Top Sender Domains\r\n**For each top sender domain that admins reported missed threats for, shows the domain's MDO-detected threat profile (emails with threats and the Malware/Phish/Spam breakdown), the count of admin FN submissions, and the submission rate (Admin Submission % = admin submissions / total inbound from the domain). A high rate can flag a domain whose mail is frequently reported as missed.**" }, "customWidth": "100", "name": "fn admin - top-sender-domains heading", "id": "1a481c97-ac85-4b62-a86d-51b33b5a8e68" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Top 10 sender domains that admins reported false negatives (missed threats) for, with each domain's MDO-detected threat profile for context.\r\nlet subs = CloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType), SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\")\r\n| summarize AdminSubmissions=count() by P2SenderDomain;\r\nlet domainProfile = EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalInbound=count(), EmailsWithThreats=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\") by SenderFromDomain;\r\nsubs\r\n| join kind=leftouter (domainProfile) on $left.P2SenderDomain == $right.SenderFromDomain\r\n| extend AdminSubmissionPct = round(AdminSubmissions * 100.0 / todouble(coalesce(TotalInbound, AdminSubmissions)), 2)\r\n| top 10 by AdminSubmissions desc\r\n| project ['Sender Domain']=P2SenderDomain, ['Emails With Threats']=coalesce(EmailsWithThreats,0), ['Malware']=coalesce(Malware,0), ['Phish']=coalesce(Phish,0), ['Spam']=coalesce(Spam,0), ['Admin Submissions']=AdminSubmissions, ['Admin Submission %']=AdminSubmissionPct", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Emails With Threats", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Malware", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "90px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Phish", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "90px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Spam", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "90px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Admin Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "120px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Admin Submission %", "formatter": 4, "formatOptions": { "palette": "red", "min": 0, "max": 20, "customColumnWidthSetting": "110px" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fn admin - top-sender-domains table", "id": "e56bed92-b0fb-4b76-90f3-169f4206418b" }, { "type": 1, "content": { "json": "### False Negative(FN) Admin Submissions by admin Detection override types\r\n**Displays the top 10 cases where emails were submitted as false negatives by admins, even though they were initially detected by Microsoft Defender for Office 365 but delivered due to an admin policy override. Includes details on PolicyOverride, PolicySource, and DetectionVerdict for deeper insight into override behaviour.**" }, "customWidth": "100", "name": "fn admin - override-types heading", "id": "293c174c-0197-4cf8-bbce-36fe42e5cf1b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was a admin policy override\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Malware (Mail)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\"))),\r\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\") and PolicyOverride !=\"NoOverride\"\r\n| summarize count() by PolicyOverride, PolicyPolicyOverrideType,DetectionVerdict,Admin_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Policy Override']=PolicyOverride, ['Override Source']=PolicyPolicyOverrideType, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ], "filter": true } }, "customWidth": "100", "name": "fn admin - override-types table", "id": "97799422-53e0-4e3b-8103-297fd1c744eb" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "8" }, "name": "group - 11-Fn Admin Submissions", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "45a1c185-4fbf-4e83-832e-1f20af427796" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
False Negative(FN) User submissions\r\n
\r\n\r\nThis section provides insights into email message **False Negative(FN) Submissions performed by end users** in Microsoft Defender for Office 365 where the message reported as having Phish, Spam threat within its content, URLs or attachments.

**Recommended action:** Recognise engaged reporters, coach over-reporters, and use graded phishing verdicts to tune anti-phishing policy." }, "name": "fn user - section header", "id": "ca0b48e6-8bd8-4f99-956a-f9c72cc870db" }, { "type": 1, "content": { "json": "### False Negative(FN) User Submissions per-{Granularity} trend by submission types \r\n**Displays counts (per {Granularity}) of False Negative(FN) User Submissions grouped by submission type (Spam, Phish and Attack simulations) . Helps to monitor where detections were missed and later submitted by users as false negatives.**" }, "name": "fn user - trend heading", "id": "60ac8608-7875-45e6-8c83-e6bd0c34af8b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize User_Phish_FN=countif(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"), User_Spam_FN=countif(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"), User_AttackSim_Submission=countif(ActionType == \"AttackSimUserSubmission\" and SubmissionContentType==\"Mail\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Phish (Mail)']=coalesce(User_Phish_FN,0), ['Spam (Mail)']=coalesce(User_Spam_FN,0), ['Attack simulation reported']=coalesce(User_AttackSim_Submission,0) | sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "TotalAdminSubmissions", "color": "redDark" }, { "seriesName": "Phish (Mail)", "color": "redDark" }, { "seriesName": "Attack simulation reported", "color": "green" }, { "seriesName": "Spam (Mail)", "color": "orangeDark" } ] } }, "name": "fn user - submissions trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "29355816-6cba-4264-938e-b0b27afdcb12" }, { "type": 1, "content": { "json": "### False Negative(FN) User Submissions by submission State\r\n**Displays the total count of False Negative(FN) User Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of user submissions and identify bottlenecks or errors.**" }, "customWidth": "50", "name": "fn user - by-state heading", "id": "6a4b32cc-b7e4-47bb-b1b9-f415df7e629c" }, { "type": 1, "content": { "json": "### False Negative(FN) User Submissions by Triage Verdict\r\n**Displays the total count of False Negative(FN)/False Positive(FP) User Submissions grouped by TriageVerdict (e.g., Malware, Spam, Phish, Clean). Helps assess how submissions were graded during triage and identify detection gaps.**" }, "customWidth": "50", "name": "fn user - triage-verdict heading", "id": "1427e34f-be44-4517-ae73-cc4776a49fe7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of user false negative submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\")\r\n| summarize count() by tostring(SubmissionState)", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "fn user - by-state pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "a6151271-e925-4804-a3c1-06afee27c026" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmissionTriage\" \r\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState, SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \r\n| summarize count() by tostring(TriageVerdict)", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "fn user - triage-verdict pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "6ff319ea-b5c5-4e33-9e5c-065aadbf465d" }, { "type": 1, "content": { "json": "### False Negative(FN) User Submissions of already detected Emails (from Junk folder)\r\n**Displays the total count of False Negative(FN) User Submissions where the email message was already detected by Microsoft Defender for Office 365 and the detection action was configured to deliver the message into the Junk folder of the user mailbox. It breaks down the result based on the original detection verdict determined by Microsoft Defender for Office 365. Helps track the user submissions of messages that already had a detection. Consider changing the detection action to Quarantine to avoid these submissions.**" }, "name": "fn user - junk-folder heading", "id": "d6338907-489d-4c88-b82f-260fc0f9d302" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where DeliveryLocation == \"Junk folder\"\r\n| summarize count() by ThreatTypes,User_SubmissionType\r\n| project ThreatTypes,User_SubmissionType, Emails = count_", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "fn user - junk-folder pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "c13452cb-e864-4f01-8623-51f3ea13bbbc" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId,UserId = (parse_json(RawEventData)).UserId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where DeliveryLocation == \"Junk folder\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| summarize TotalJunkSubmittedEmailCount=count(),PhishEmailCount = countif(FirstDetection == \"Phish\"),SpamEmailCount = countif(FirstDetection == \"Spam\") by tostring(UserId)\r\n| top 15 by TotalJunkSubmittedEmailCount desc\r\n| project ['User']=UserId, ['Junk Submissions']=TotalJunkSubmittedEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Junk Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Phish", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Spam", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "50", "name": "fn user - junk-folder table", "id": "b242f301-c9f7-41f9-aa73-03848bd58eae" }, { "type": 1, "content": { "json": "### False Negative(FN) User Submissions - Admin review status (Mark and Notify)\r\n**Displays counts of False Negative(FN) User Submissions that were reviewed by admins and marked with a notify action. The Mark and Notify action also can be taken automatically with Automated investigation and response (AIR). Helps track cases where admins confirmed user reports and communicated the outcome, supporting transparency and user trust.**" }, "customWidth": "50", "name": "fn user - mark-notify heading", "id": "784bf171-53ae-4907-b2b0-7fc5039df231" }, { "type": 1, "content": { "json": "### False Negative(FN) User Submissions accuracy vs Admin review verdict\r\n**Displays counts of False Negative(FN) User Submissions (Phish, Junk, NotJunk) compared to admin review results. Highlights whether submissions were Correct, Not Correct, or misclassified comparing user submission type with the Admin decision using Mark and Notify action in Microsoft Defender for Office 365 (e.g., “Phish reported as Junk”, “Reported but not malicious”).**" }, "customWidth": "50", "name": "fn user - accuracy heading", "id": "3d137383-6436-4213-9824-72f424b67290" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises user submissions where admin also performed 'mark and notify' action on the submission\r\nlet ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\r\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\r\n| mv-expand element = Properties\r\n| where element.Name == \"AdminReviewResult\"\r\n| project SubmissionId, AdminReviewResult = element.Value;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\r\n| join kind=leftouter ReviewResults on SubmissionId\r\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\r\n| extend ReviewedAccuracy=iif(UserReportedAs==AdminReviewResult, 1,0)\r\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\r\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\r\n| summarize count() by Reviewed", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "fn user - mark-notify pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "7bb7d116-bd61-4e46-81dd-d634a31e7369" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises user submissions type compared to admin review verdict. \r\n//Eg. User reporting a phish but admin review is 'not threat found'\r\nlet ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\r\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\r\n| mv-expand element = Properties\r\n| where element.Name == \"AdminReviewResult\"\r\n| project SubmissionId, AdminReviewResult = element.Value;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\r\n| join kind=leftouter ReviewResults on SubmissionId\r\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\r\n| extend ReviewedAccuracy=iif(AdminReviewResult==UserReportedAs, \"Correct\", iif(AdminReviewResult==\"Phish\" and UserReportedAs == \"Junk\", \"Phish reported as junk\",iif(AdminReviewResult==\"Junk\" and UserReportedAs == \"Phish\",\"Junk reported as Phish\",iif(AdminReviewResult==\"NotJunk\",\"Reported but not malicious or spam\",iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Not correct\")))))\r\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\r\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\r\n| where Reviewed==\"Reviewed\"\r\n| summarize count() by ReviewedAccuracy", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "fn user - accuracy pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "8af1b9f0-995c-4c58-9960-8e69c6960987" }, { "type": 1, "content": { "json": "### Top 10 P2 Email Senders domains in False Negative(FN) User Submissions \r\n**Displays the top 10 P2 email sender domains of inbound emails reported by users as false negatives (missed detections). Includes total inbound email volume and calculates the percentage of user submissions per domain to highlight high-risk sources.**" }, "customWidth": "100", "name": "fn user - top-p2-domains heading", "id": "78dab1f9-09ec-46e2-aee4-f256e368cdd5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises top 10 sender domains of inbound emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Inbound\"\r\n| summarize count() by SenderFromDomain;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize UserSubmissions=count() by SenderFromDomain\r\n| join TotalInboundbySender on SenderFromDomain\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Domain']=SenderFromDomain, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "User Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "14ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Inbound", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "User Submission %", "formatter": 4, "formatOptions": { "customColumnWidthSetting": "12ch", "palette": "red", "min": 0, "max": 20 }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fn user - top-p2-domains table", "id": "6e6a59d4-70e1-4d85-bebb-6bb23d25d2d9" }, { "type": 1, "content": { "json": "### Top 10 P2 Individual Email Senders in False Negative(FN) User Submissions \r\n**Displays the top 10 P2 individual email sender addresses of inbound emails reported by users as false negatives (missed detections). Includes total inbound email volume and calculates the percentage of user submissions per sender to highlight high-risk sources.**" }, "customWidth": "100", "name": "fn user - top-p2-senders heading", "id": "a6e8fda5-dd05-49ed-87e2-16443495396e" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises top 10 sender email addresses of inbound emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Inbound\"\r\n| summarize count() by SenderFromAddress;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize UserSubmissions=count() by SenderFromAddress\r\n| join TotalInboundbySender on SenderFromAddress\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "User Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "14ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Inbound", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "User Submission %", "formatter": 4, "formatOptions": { "customColumnWidthSetting": "12ch", "palette": "red", "min": 0, "max": 20 }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fn user - top-p2-senders table", "id": "878fd15f-2607-4d6d-b919-0b4bea6a1850" }, { "type": 1, "content": { "json": "### Top 10 Intra-org Email Senders in False Negative(FN) User Submissions \r\n**Displays the top 10 email senders of intra-org emails reported by users as false negatives (missed detections). Includes total intra-org email volume and calculates the percentage of user submissions per sender to highlight high-risk sources.**" }, "customWidth": "100", "name": "fn user - intraorg-senders heading", "id": "87a51814-7f01-42e3-aea2-4136c869d39d" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises top 10 sender email address of intra-org emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Intra-org\"\r\n| summarize count() by SenderFromAddress;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize UserSubmissions=count() by SenderFromAddress\r\n| join TotalInboundbySender on SenderFromAddress\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Intra-org']=count_, ['User Submission %']=UserSubmissions_Percentage", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "User Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "14ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Intra-org", "formatter": 0, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "User Submission %", "formatter": 4, "numberFormat": { "unit": 1, "options": { "style": "decimal" } }, "formatOptions": { "palette": "red", "min": 0, "max": 20, "customColumnWidthSetting": "12ch" } } ], "filter": true } }, "customWidth": "100", "name": "fn user - intraorg-senders table", "id": "38edca4b-a403-41e8-8c2b-7c0595e93b7a" }, { "type": 1, "content": { "json": "### Top 10 Intra-org Email Subjects in False Negative(FN) User Submissions \r\n**Displays the top 10 Email Subjects of intra-org emails reported by users as false negatives (missed detections). Helps to highlight high-risk intra-org email sources.**" }, "customWidth": "100", "name": "fn user - intraorg-subjects heading", "id": "52b0bc5b-7e54-4a5b-a487-8a736a8c2397" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises top 10 subjects of intra-org emails submitted as false negatives by users.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize count() by Subject\r\n| top 10 by count_ desc\r\n| project ['Subject']=Subject, ['User Submissions']=count_", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Subject", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "70ch" } }, { "columnMatch": "User Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fn user - intraorg-subjects table", "id": "ee2c1d2e-3d4e-4024-8422-985b22cb7475" }, { "type": 1, "content": { "json": "### Top 10 Detection Overrides defined by Admins in False Negative(FN) User Submissions \r\n**Displays the top 10 use cases where users submitted emails as false negatives (Spam or Phish) that were already detected by Microsoft Defender for Office 365 but delivered due to an admin-defined policy override. Includes details on OrgLevelAction, OrgLevelPolicy, and ThreatTypes for deeper insight into override behaviour.**" }, "customWidth": "100", "name": "fn user - admin-override heading", "id": "0dd9b3ce-9716-42bb-93de-495f0af2d075" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an admin definded policy override.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where ThreatTypes !=\"\"and OrgLevelAction!=\"\"\r\n| summarize count() by OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Override Policy", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "48ch" } }, { "columnMatch": "User Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fn user - admin-override table", "id": "100de6ca-beb0-44d7-a715-449a389e9e8a" }, { "type": 1, "content": { "json": "### Top 10 Detection Overrides defined by Users in False Negative(FN) User Submissions \r\n**Displays the top 10 use cases where users submitted emails as false negatives (Spam or Phish) that were already detected by Microsoft Defender for Office 365 but delivered due to a user-defined override. Includes details on UserLevelAction, UserLevelPolicy, and ThreatTypes for deeper insight into override behaviour.**" }, "customWidth": "100", "name": "fn user - user-override heading", "id": "67057c7d-c0af-4373-b23a-4001fbced888" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an policy override.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where ThreatTypes !=\"\"and UserLevelAction!=\"\"\r\n| summarize count() by UserLevelAction, UserLevelPolicy,ThreatTypes,User_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Override Policy", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "48ch" } }, { "columnMatch": "User Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fn user - user-override table", "id": "1b97f7d2-152d-4eb0-bfac-e161fbfa4046" }, { "type": 1, "content": { "json": "### Top 10 users performing the most False Negative(FN) User Submissions\r\n**Displays the Top 10 user accounts that performed the highest number of False Negative(FN) User Submissions (missed detections). Helps identify individuals most engaged in reporting suspicious, malicious messages and potential patterns in detection gaps.**" }, "customWidth": "100", "name": "fn user - top-users heading", "id": "7799a0a0-a835-4080-b59a-736b08ad809e" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the top 10 users performing false negative submissions\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\")\r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 10 by ['Submissions'] desc", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "16ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fn user - top-users pie", "id": "44838734-43a0-4301-9ddb-a644c7ec509a" }, { "type": 1, "content": { "json": "### Top 10 users performing the most User Submissions of Attack simulation messages\r\n**Displays the top 10 user accounts that reported phishing simulation emails during cyber security awareness campaigns. Supports evaluation of cyber security awareness programme effectiveness and identifies highly engaged users.**" }, "customWidth": "100", "name": "fn user - attacksim-users heading", "id": "8a96e90f-765f-40c0-8476-30c97d43c328" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the top users reporting the phishing simulation emails.\r\nCloudAppEvents \r\n| extend Record= (parse_json(RawEventData)).RecordType \r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState \r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| where Record == 29\r\n| where ActionType == \"AttackSimUserSubmission\" \r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 10 by ['Submissions'] desc", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "16ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fn user - attacksim-users pie", "id": "ab648c4a-4c46-4c73-96f0-784c9bcef961" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "8" }, "name": "group - 11 - FN User submissions", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "348ce24a-7cbc-4b66-a471-dfe3827bed2d" }, { "type": 1, "content": { "json": "# False Positive(FP) Submissions insights\r\n\r\n---\r\n\r\nThis tab provides insights into email message **False Positive(FP) Submissions** performed by users or administrators in Microsoft Defender for Office 365 where the message was flagged as a threat by Microsoft Defender for Office 365 but was later reported as No Threat by administrators or users." }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "10" }, "name": "fp - tab description", "id": "78e2df52-a0d2-499a-95fe-708f67db5ad6" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
False Positive(FP) Admin Submissions\r\n
\r\n\r\nAdministrator submissions represent escalated false positive reports submitted by security team members rather than end users. These typically involve more complex cases requiring expert review, such as recurring issues affecting multiple users, business-critical communications being blocked, or suspected policy misconfigurations. Admin submissions carry higher priority and can result in actions as allow-list additions or global policy changes to prevent widespread user impact.

**Recommended action:** Review recurring false-positive sender domains and consider allow entries or policy tuning to reduce business disruption." }, "name": "fp admin - section header", "id": "02d54e9c-e989-4cde-a128-68a6381ed9d7" }, { "type": 1, "content": { "json": "### Admin Submission Volume and Type Breakdown\r\n\r\n**These charts track the volume and composition of administrator-initiated false positive submissions. The trend chart shows submission patterns (per {Granularity}) across Email, URL, and Attachment types, while the pie chart reveals the distribution among these categories. Spikes in admin submissions often signal systemic issues requiring immediate policy review, as admins typically escalate only the most impactful or recurring problems.**" }, "name": "fp admin - volume/type heading", "id": "103b8362-a10f-4b46-a757-8290c4269a5c" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the daily ammount of admin false positive submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize Admin_Email_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_URL_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Attach_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Email']=coalesce(Admin_Email_FP,0), ['URL']=coalesce(Admin_URL_FP,0), ['Attachment']=coalesce(Admin_Attach_FP,0) | sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "TotalAdminSubmissions", "color": "redDark" }, { "seriesName": "Admin_Phish_FN", "color": "redBright" }, { "seriesName": "Admin_Spam_FN", "color": "orange" }, { "seriesName": "Admin_Malware_FN", "color": "redDark" }, { "seriesName": "Admin_Phish_URL_FN", "color": "purple" }, { "seriesName": "Admin_Malware_Attach_FN", "color": "yellowDark" }, { "seriesName": "Admin_Phish_Attach_FN", "color": "purpleDark" }, { "seriesName": "Admin_Malware_URL_FN", "color": "yellow" }, { "seriesName": "Admin_Email_FP", "color": "redDark" }, { "seriesName": "Admin_URL_FP", "color": "orangeDark" }, { "seriesName": "Admin_Attach_FP", "color": "yellow" } ] } }, "customWidth": "66", "name": "fp admin - submissions trend", "id": "326762ca-1f2b-48e9-90d6-ff2aa6a75e95" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of admin false positive submission by submission type.\r\nCloudAppEvents \r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Email\",\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"URL\",\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Attachment\",\r\n\"Other\")))\r\n| where Admin_SubmissionType!=\"Other\"\r\n| summarize count() by Admin_SubmissionType", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart", "chartSettings": { "createOtherGroup": 10 } }, "customWidth": "33", "name": "fp admin - by-type pie", "id": "be925c4c-5718-4385-8e82-59c57b975ac5" }, { "type": 1, "content": { "json": "### False Positive(FP) Admin Submissions by submission state
\r\n\r\n**Displays the total count of False Positive(FP) Admin Submissions by submission State (e.g., Pending, Completed, Failed). Helps track the processing status of admin submissions and identify bottlenecks or errors.**" }, "customWidth": "50", "name": "fp admin - by-state heading", "id": "2b2acb67-c070-48bd-acf1-025c05aae8b5" }, { "type": 1, "content": { "json": "### Top Admins Submitting False Positives
\r\n\r\n**Displays the top 15 admin accounts that submitted the highest number of false positive messages via AdminSubmission.**" }, "customWidth": "50", "name": "fp admin - top-admins heading", "id": "52206f40-fae9-460f-97b8-2cf9b633098f" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of admin false positive submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| summarize count() by tostring(SubmissionState)", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "fp admin - by-state pie", "id": "96133d9e-24fb-417e-a3cd-df98dda4c60a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the top admins performing false positive submissions.\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType \r\n| where Record == 29 and SubmissionType ==\"3\"\r\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "16ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "50", "name": "fp admin - top-admins pie", "id": "da7b4c89-904d-4917-b6cd-04b32e02d4a1" }, { "type": 1, "content": { "json": "### Admin Submission False Positive Malware Detection Breakdown\r\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as malware) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as malware.**" }, "customWidth": "100", "name": "fp admin - malware-detection heading", "id": "69d649e0-86fd-4c08-afd4-e6c200b11c86" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Admin false positive submissions whose original verdict was Malware, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Malware.\r\nlet total = toscalar(CloudAppEvents\r\n | where ActionType == \"AdminSubmissionSubmitted\"\r\n | extend R = parse_json(RawEventData)\r\n | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Malware\"\r\n | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Malware\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Malware FPs'] = Pct", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "FP Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Distinct Sender Domains", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "% of", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "14ch" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fp admin - malware-detection table", "id": "607eb19b-1ded-488d-98db-8b23f9e90967" }, { "type": 1, "content": { "json": "### Admin Submission False Positive Phish Detection Breakdown\r\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as phishing) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as phishing.**" }, "customWidth": "100", "name": "fp admin - phish-detection heading", "id": "c1f1e12f-d0aa-4023-9172-8182772b3331" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Admin false positive submissions whose original verdict was Phish, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Phish.\r\nlet total = toscalar(CloudAppEvents\r\n | where ActionType == \"AdminSubmissionSubmitted\"\r\n | extend R = parse_json(RawEventData)\r\n | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Phish\"\r\n | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Phish\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Phish FPs'] = Pct", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "FP Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Distinct Sender Domains", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "% of", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "14ch" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fp admin - phish-detection pie", "id": "b6c074f9-affa-41a3-802a-53541394ae73" }, { "type": 1, "content": { "json": "### Admin Submission False Positive Spam Detection Breakdown\r\n**Shows the count of administrator-submitted false positive reports (legitimate emails flagged as spam) grouped by the detection method that flagged them. Helps identify which filtering technologies most often misclassify valid messages as spam.**" }, "customWidth": "100", "name": "fp admin - spam-detection heading", "id": "f0f2adb9-34af-4df0-90e6-087a265bedf6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Admin false positive submissions whose original verdict was Spam, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Spam.\r\nlet total = toscalar(CloudAppEvents\r\n | where ActionType == \"AdminSubmissionSubmitted\"\r\n | extend R = parse_json(RawEventData)\r\n | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Spam\"\r\n | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Spam\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Spam FPs'] = Pct", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "FP Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Distinct Sender Domains", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "20ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "% of", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "14ch" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fp admin - spam-detection pie", "id": "e877d9c9-3bd3-4368-997e-945f18ffcf5f" }, { "type": 1, "content": { "json": "### Top 10 Sender Domains for Admin False Positive Submissions
\r\n\r\n**Lists the top 10 sender domains of emails reported as false positives by administrators (legitimate messages incorrectly flagged as spam or phishing). Helps identify domains frequently misclassified.**" }, "customWidth": "50", "name": "fp admin - top-sender-domains heading", "id": "37680101-7e4b-4bcc-9e7e-0ccd2d914881" }, { "type": 1, "content": { "json": "### Admin False Positive Submissions by Original Threat Verdict
\r\n\r\n**Displays all administrator-submitted false positive emails by their original filter verdict (e.g., spam, phishing) and policy override details. Helps identify which threat categories are most often misclassified.**" }, "customWidth": "50", "name": "fp admin - by-verdict heading", "id": "879e81ad-00a6-4a10-bcb6-56879133bb9f" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the top 10 sender domains of emails which are submitted as false positive by admins\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType ==\"3\"\r\n| summarize count() by P2SenderDomain\r\n| top 10 by count_ desc\r\n| project ['Sender Domain']=P2SenderDomain, ['Emails']=count_", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ], "filter": true } }, "customWidth": "50", "name": "fp admin - top-sender-domains table", "id": "42844dc9-4418-487b-a5ad-31e1f6b4b487" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ,\"Email\",\r\n\"Other\"),\r\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| summarize count() by PolicyOverride,DetectionVerdict,Admin_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Policy Override']=PolicyOverride, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Emails", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "40ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ], "filter": true } }, "customWidth": "50", "name": "fp admin - by-verdict table", "id": "3ebbd402-06ef-45a7-b4ee-c5938b98b540" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "10" }, "name": "fp admin - group", "styleSettings": { "showBorder": true }, "id": "b6215b53-c181-4693-a14f-441809f65f38" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
False Positive (FP) User Submissions\r\n
\r\n\r\nThis section provides insights into email message False Postive(FP) Submissions performed by end users in Microsoft Defender for Office 365 where the message was flagged as a threat by Microsoft Defender for Office 365 but was later reported as No Threat by users. User submissions are critical feedback mechanisms that help security teams identify overly aggressive detection rules, refine security policies, and reduce user friction. High false positive rates can erode user trust and lead to security fatigue, so monitoring these metrics helps balance protection with productivity.

**Recommended action:** High user false-positive volume suggests over-aggressive filtering - review the affected senders and adjust policy." }, "name": "fp user - section header", "id": "0d93d7ee-a61e-43b7-bdcd-172bd79ad050" }, { "type": 1, "content": { "json": "### User Submission Trend\r\n\r\n**Displays the volume (per {Granularity}) of false positive submissions from end users. A sudden spike may indicate a new detection rule causing widespread misclassification, while a declining trend suggests improving detection accuracy. Monitoring this trend helps security teams respond quickly to detection issues before they impact user productivity.**" }, "name": "fp user - trend heading", "id": "c3f8ae45-0498-4fa8-b9d1-35e926932639" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the daily ammount of user false positive submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where SubmissionType == \"3\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User FP Submissions'] = coalesce(Count, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "User FP Submissions", "color": "blueDark" } ] } }, "customWidth": "100", "name": "fp user - submissions trend", "id": "847032f5-56a8-4681-9665-9e917c7c9355" }, { "type": 1, "content": { "json": "### User False Positive Submissions by State
\r\n\r\n**Displays the total number of user-reported false positive email submissions grouped by their processing state (e.g., pending, completed). Helps track submission workflow and resolution progress.**" }, "customWidth": "50", "name": "fp user - by-state heading", "id": "7bd03278-7734-4fbf-a502-95b42e90160e" }, { "type": 1, "content": { "json": "### Top Users Performing False Positive Submissions
\r\n\r\n**Lists the top 15 users who reported emails as false positives (legitimate messages incorrectly flagged as threats). Helps identify frequent reporters and potential training or policy adjustment needs.**" }, "customWidth": "50", "name": "fp user - top-users heading", "id": "7e2b987b-325d-4f69-8d6b-fafd6676a03a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of user false positive submission by submission state.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| summarize count() by tostring(SubmissionState)", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "fp user - by-state pie", "id": "df79d08b-3eac-4101-a3f2-3a4a3bf450ce" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the top users performing false positive submissions.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "16ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "50", "name": "fp user - top-users pie", "id": "ec7505d8-3a70-4bde-a985-baf5a0c4ec34" }, { "type": 1, "content": { "json": "### User Submission False Positive Malware Detection Breakdown\r\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as malware) grouped by the detection technique that flagged them. Malware quarantine is admin-only by default, so this table only populates when a custom quarantine policy lets users view and report their own malware detections - it is usually empty.**" }, "customWidth": "100", "name": "fp user - malware-verdict heading", "id": "693b1072-5ddd-49d0-a0f5-2bba4c287edf" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//User false positive submissions whose email was originally flagged as Malware, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Malware.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Malware\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "FP Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Distinct Sender Domains", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "22ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fp user - malware-verdict table", "id": "10ea55bd-937e-454d-b6cc-a9dccfdf3417" }, { "type": 1, "content": { "json": "### User Submission False Positive Phish Detection Breakdown\r\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as phishing) grouped by the detection technique that flagged them. Helps identify which filtering technologies most often misclassify valid messages as phishing.**" }, "customWidth": "100", "name": "fp user - phish-verdict heading", "id": "6dd14abb-2772-4271-89d8-8c0dcdbfd9e5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//User false positive submissions whose email was originally flagged as Phish, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Phish.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Phish\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "FP Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Distinct Sender Domains", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "22ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fp user - phish-verdict pie", "id": "57049aad-eb17-4e65-a8a4-b5d05b0501cd" }, { "type": 1, "content": { "json": "### User Submission False Positive Spam Detection Breakdown\r\n**Shows the count of user-submitted false positive reports (legitimate emails flagged as spam) grouped by the detection technique that flagged them. Helps identify which filtering technologies most often misclassify valid messages as spam.**" }, "customWidth": "100", "name": "fp user - spam-verdict heading", "id": "5479b2ed-b629-41e7-9857-c91191b09c8f" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//User false positive submissions whose email was originally flagged as Spam, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Spam.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Spam\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "FP Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Distinct Sender Domains", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "22ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fp user - spam-verdict pie", "id": "45a2122e-0281-4602-906d-a0406ed20d54" }, { "type": 1, "content": { "json": "### Top 10 Sender Domains for User False Positive Submissions
\r\n\r\n**Lists the top 10 sender domains of emails reported as false positives by users (legitimate messages incorrectly flagged as threats). Helps identify domains frequently misclassified.**" }, "customWidth": "100", "name": "fp user - top-sender-domains heading", "id": "2751fca4-3ac5-45fe-a965-8c811018926a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Top 10 sender domains reported as false positives by users, with each domain's total inbound volume and the share of it reported as FP (a high rate flags a domain whose legitimate mail is most often misclassified).\r\nlet totalByDomain = EmailEvents | where EmailDirection == \"Inbound\" | summarize TotalInbound = count() by SenderFromDomain;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| summarize FPSubmissions = count() by P2SenderDomain\r\n| join kind=leftouter (totalByDomain) on $left.P2SenderDomain == $right.SenderFromDomain\r\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Domain'] = P2SenderDomain, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "FP Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Inbound", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "18ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "FP Submission %", "formatter": 4, "formatOptions": { "palette": "red", "min": 0, "max": 20, "customColumnWidthSetting": "16ch" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fp user - top-sender-domains table", "id": "c69b126d-9f25-44a0-b96d-601d89a563f1" }, { "type": 1, "content": { "json": "### Top 10 Senders in User False Positive Submissions
\r\n\r\n**Displays the top 10 email senders whose messages were reported as false positives by users (legitimate emails incorrectly flagged as threats). Helps identify senders frequently misclassified.**" }, "customWidth": "100", "name": "fp user - top-senders heading", "id": "b39966ad-2b40-4144-ae3f-c7ac6b9fb97c" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Top 10 email senders reported as false positives by users, with each sender's total inbound volume and the share reported as FP.\r\nlet totalBySender = EmailEvents | where EmailDirection == \"Inbound\" | summarize TotalInbound = count() by SenderMailFromAddress;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize FPSubmissions = count() by SenderMailFromAddress\r\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\r\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "FP Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Inbound", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "18ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "FP Submission %", "formatter": 4, "formatOptions": { "palette": "red", "min": 0, "max": 20, "customColumnWidthSetting": "16ch" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fp user - top-senders table", "id": "077ab610-58ed-4d23-886c-dbf912cef2d7" }, { "type": 1, "content": { "json": "### Top 10 Subjects in User False Positive Submissions
\r\n\r\n**Displays the top 10 email subjects reported as false positives by users (legitimate messages incorrectly flagged as threats). Helps identify common patterns in misclassified emails.**" }, "customWidth": "100", "name": "fp user - top-subjects heading", "id": "a5b939e1-0fbf-4ee1-a6a3-01fa7639af3a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Top 10 email subjects reported as false positives by users, with how many distinct recipients reported each (a subject reported by many users is a broad misclassification pattern).\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize FPSubmissions = count(), DistinctRecipients = dcount(RecipientObjectId) by Subject\r\n| top 10 by FPSubmissions desc\r\n| project ['Subject'] = Subject, ['FP Submissions'] = FPSubmissions, ['Distinct Recipients'] = DistinctRecipients", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Subject", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "70ch" } }, { "columnMatch": "FP Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Distinct Recipients", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "18ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ], "filter": true } }, "customWidth": "100", "name": "fp user - top-subjects table", "id": "71d5c290-f5d0-493c-b821-b5345dbe7312" }, { "type": 1, "content": { "json": "### Top 10 Intra-Org Senders in User False Positive Submissions
\r\n\r\n**Displays the top 10 internal senders whose emails were reported as false positives by users (legitimate intra-org messages incorrectly flagged as threats). Helps identify internal communication patterns causing misclassification.**" }, "customWidth": "100", "name": "fp user - intraorg-senders heading", "id": "1d38f458-dfde-4608-ad7d-ee8628e85ee7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Top 10 internal senders whose emails were reported as false positives by users, with total intra-org volume and the share reported as FP.\r\nlet totalBySender = EmailEvents | where EmailDirection == \"Intra-org\" | summarize TotalIntraOrg = count() by SenderMailFromAddress;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize FPSubmissions = count() by SenderMailFromAddress\r\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\r\n| extend FPPct = iif(isnull(TotalIntraOrg) or TotalIntraOrg == 0, 0.0, round(FPSubmissions * 100.0 / TotalIntraOrg, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Intra-org'] = coalesce(TotalIntraOrg, 0), ['FP Submission %'] = FPPct", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "FP Submissions", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } }, { "columnMatch": "Total Intra-org", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "18ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "FP Submission %", "formatter": 4, "formatOptions": { "palette": "red", "min": 0, "max": 20, "customColumnWidthSetting": "16ch" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "fp user - intraorg-senders table", "id": "b6699a7f-897a-4016-ae2c-d816f3a9492b" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "10" }, "name": "fp user - group", "styleSettings": { "showBorder": true }, "id": "2ad3311e-e92b-4a49-bdd0-775f085c4587" }, { "type": 1, "content": { "json": "# File Malware Detections (SharePoint, Teams and OneDrive)\r\n\r\n---\r\n\r\nThis tab provides insights into malicious file detections across Microsoft collaboration platforms such as SharePoint, OneDrive, and Teams.\r\n\r\n[

Safe Attachments for SharePoint, OneDrive, and Microsoft Teams

](https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-for-spo-odfb-teams-about)\r\n[

Built-in virus protection in SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams

](https://learn.microsoft.com/en-us/defender-office-365/anti-malware-protection-for-spo-odfb-teams-about) " }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "9" }, "name": "filemal - tab description", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "cefcac88-f373-4748-b0ea-e7600f63edd7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Microsoft Defender for Office 365 value for files in SharePoint / OneDrive / Teams: total files processed, how many had a malware detection, and how many were scanned with no detection. A per-period Trend series feeds the tile sparkline.\r\nlet gran = {Granularity};\r\nlet base = FileMaliciousContentInfo;\r\nlet counts = union\r\n(base | summarize Count = count() | extend Cat = \"Total Files Processed (SPO/ODB/Teams)\", Ord = 1),\r\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Cat = \"Files with Malware Detected\", Ord = 2),\r\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Cat = \"Files Scanned - No Detection\", Ord = 3);\r\nlet tagged = union\r\n(base | extend Cat = \"Total Files Processed (SPO/ODB/Teams)\"),\r\n(base | where isnotempty(ThreatTypes) | extend Cat = \"Files with Malware Detected\"),\r\n(base | where isempty(ThreatTypes) | extend Cat = \"Files Scanned - No Detection\");\r\nlet trends = tagged | make-series Trend = count() default = 0 on Timestamp step gran by Cat;\r\ncounts\r\n| join kind=leftouter (trends) on Cat\r\n| sort by Ord asc\r\n| project Count, Details = Cat, Trend", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Details", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "min": 0, "palette": "blue" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, "secondaryContent": { "columnMatch": "Trend", "formatter": 21, "formatOptions": { "min": 0, "palette": "blue" } }, "showBorder": true, "size": "auto" } }, "customWidth": "100", "name": "filemal - MDO value tiles", "id": "843e58a9-6324-4a90-a652-bfb0549e79dc", "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "9" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
File Malware Detection (SharePoint, OneDrive, and Teams)\r\n
\r\n\r\nThis section monitors malware detections in files stored across Microsoft 365 collaboration platforms. Microsoft Defender for Office 365 and built-in SharePoint Online antivirus work together to scan files uploaded to SharePoint, OneDrive, and Teams. Understanding file-based malware patterns helps protect collaborative workspaces and identify potential security risks in shared content.

**Recommended action:** For repeat file owners or sites, investigate possible compromise and confirm Safe Attachments for SharePoint, OneDrive and Teams is enabled." }, "name": "filemal - section header", "id": "373fe4e5-fc90-49cf-93ba-c8b100efce57" }, { "type": 1, "content": { "json": "### File Malware Detection Trend
\r\n\r\n**This visual tracks the volume (per {Granularity}) of malware detections in files across all Microsoft 365 workloads. Spikes in detection activity may indicate targeted attacks or emerging malware campaigns affecting collaborative platforms. Regular monitoring helps identify unusual patterns that require investigation.**" }, "name": "filemal - trend heading", "id": "30145585-8998-443a-b6ec-062d136c621f" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(FileMaliciousContentInfo\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Files']=coalesce(Count, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "tileSettings": { "showBorder": false }, "graphSettings": { "type": 0 }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Files", "color": "blueDark" } ], "showDataPoints": true } }, "customWidth": "100", "name": "filemal - detection trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "d39cea9b-75a8-4c29-bfdb-2e0db855e98a" }, { "type": 1, "content": { "json": "### Malware Family Analysis - Defender for Office 365\r\n**Provides a breakdown of malware detections in files scanned by Microsoft Defender for Office 365 (Safe Attachments detonation) across SharePoint, OneDrive, and Teams. The table lists each malware family with total detections, distinct files, affected locations and when it was last seen, helping identify dominant threats and their spread across collaboration platforms.**" }, "customWidth": "100", "name": "filemal - family MDO heading", "id": "4e330873-f732-4d37-a7b0-dced08b019b0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query summarizes File malware detections by Microsoft Defender for Office 365 (Safe Attachments detonation) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\r\nFileMaliciousContentInfo\r\n| where tostring(DetectionMethods) contains \"detonation\"\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\r\n| sort by ['Files'] desc\r\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "RawinfoVirusInfo", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "RawinfoVirusInfo", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "RawinfoVirusInfo", "createOtherGroup": 15 }, "gridSettings": { "formatters": [ { "columnMatch": "Files", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "filemal - family MDO table", "id": "c3fbb1c9-be67-43b9-9a32-7fb265a84ffc" }, { "type": 1, "content": { "json": "### Malware Family Analysis - SharePoint AV\r\n**Provides a breakdown of malware detections in files across SharePoint, OneDrive, and Teams caught by the built-in SharePoint antivirus (Antimalware engine). The table lists each malware family with total detections, distinct files, affected locations and when it was last seen, helping identify prevalent threats and their spread across collaboration environments.**" }, "customWidth": "100", "name": "filemal - family SPO-AV heading", "id": "331a8361-6e81-4615-b33a-97ebb3e31529" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query summarizes File malware detections by the built-in SharePoint antivirus (Antimalware engine) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\r\nFileMaliciousContentInfo\r\n| where tostring(DetectionMethods) contains \"Antimalware engine\"\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\r\n| sort by ['Files'] desc\r\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "chartSettings": { "xAxis": "RawinfoVirusInfo", "createOtherGroup": 10 }, "gridSettings": { "formatters": [ { "columnMatch": "Files", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "filemal - family SPO-AV table", "id": "bbcdccd9-eedb-476a-a0e7-8504f8770229" }, { "type": 1, "content": { "json": "### Malware Detections by Location
\r\n\r\n**Displays the number of malware detections grouped by specific SharePoint sites or OneDrive locations. Helps identify which sites have the highest volume of detected threats for targeted remediation and security hardening.**" }, "customWidth": "50", "name": "filemal - by-location heading", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "c5668d6e-7c0e-4ce3-9509-ca93dda3efad" }, { "type": 1, "content": { "json": "### Malware Detections by Application
\r\n\r\n**Summarizes malware detections across Microsoft collaboration apps, including SharePoint, OneDrive, and Teams. Helps identify which applications experience the highest volume of detected threats for targeted security measures.**" }, "customWidth": "50", "name": "filemal - by-application heading", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "07e64ca9-04a2-44b2-a044-e927bc73ef1b" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query lists total Malware detections of files on SharePoint, OneDrive and Teams by the location (site or personal path) where the file resides.\r\nFileMaliciousContentInfo\r\n| extend ['Site / Location'] = tostring(split(FolderPath, '/')[4])\r\n| summarize ['Detections'] = count() by ['Site / Location']\r\n| sort by ['Detections'] desc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Detections", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "50", "name": "filemal - by-location table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "3ce3ea65-a4df-450f-871c-8956d59818a9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams summarizing the data by the Microsoft collaboration application (workload).\r\nFileMaliciousContentInfo\r\n| summarize count() by Workload\r\n| sort by count_ desc", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "50", "name": "filemal - by-application pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "003afc8e-0403-4aa9-9084-a3c2e435216a" }, { "type": 1, "content": { "json": "### Top File Owners Holding Malware\r\n**Lists the users (or the SharePoint/Teams site, when a file has no individual owner) whose files in SharePoint, OneDrive or Teams were flagged as malware, with the count of malicious files, distinct files, affected workloads and sample threat names. Helps pinpoint the accounts and collaboration locations most affected by malicious content for targeted remediation.**" }, "customWidth": "100", "name": "filemal - top-owners heading", "id": "c2f8d3b5-0a4e-4b7c-9d23-8e6f0a1b2c34" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Top file owners (or the SharePoint/Teams site, when a file has no user owner) whose SharePoint/OneDrive/Teams files were flagged as malware, with distinct files, workloads and sample threat names.\r\nFileMaliciousContentInfo\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Malicious Files'] = count(),\n ['Distinct Files'] = dcount(SHA256),\n ['Workloads'] = make_set(Workload, 3),\n ['Sample Threats'] = make_set_if(ThreatNames, isnotempty(ThreatNames), 5),\n ['Last Seen'] = max(Timestamp)\n by ['Owner']=Owner\n| top 20 by ['Malicious Files']", "size": 0, "title": "Top File Owners Holding Malware", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "Malicious Files", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Distinct Files", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] } }, "name": "filemal - top-owners table", "id": "36d9a683-9f9d-4a70-84d9-ec351542f827" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "9" }, "name": "filemal - group", "styleSettings": { "showBorder": true }, "id": "50886cd9-87bf-4a84-bd80-d7f44441b3f7" }, { "type": 1, "content": { "json": "# Post-Delivery & Quarantine Insights\r\n\r\n---\r\nThis tab covers what happens to threats **after delivery**: Zero-hour Auto Purge (ZAP) remediation of malicious messages already in mailboxes, and quarantine management - what is held, released, and by whom. Together they show how effectively post-delivery response contains threats that reached the inbox." }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "11" }, "name": "postdelivery - tab description", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "93371620-d968-4987-bddd-6c9b9e5a0344" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Post Delivery Protection offered by ZAP\r\n
\r\n\r\nThis section provides insights into Microsoft Defender for Office 365's post-delivery protection capabilities through Zero-Hour Auto Purge (ZAP). ZAP is a critical security feature that continuously monitors delivered emails and automatically removes messages that are later identified as malicious. These visuals help track ZAP effectiveness, response times, and remediation patterns.

**Recommended action:** High post-delivery ZAP volume means threats are reaching inboxes before being caught - review pre-delivery filtering and detection latency." }, "name": "postdelivery - section header", "id": "b22ee5f1-a2dc-4509-92a3-1dbcad3a6ee7" }, { "type": 1, "content": { "json": "### ZAP Post-Delivery Actions (per {Granularity})
\r\n\r\n**Shows the count (per {Granularity}) of emails that were remediated post-delivery by Zero-Hour Auto Purge (ZAP). Helps track how often threats are detected and removed after reaching user mailboxes.**" }, "customWidth": "50", "name": "postdelivery - zap-actions heading", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "af1aa73f-d952-4827-bcc9-b97a19016829" }, { "type": 1, "content": { "json": "### ZAP Actions by Detection Type (per {Granularity})
\r\n\r\n**Visualizes the count (per {Granularity}) of post-delivery remediation actions performed by Zero-Hour Auto Purge (ZAP), broken down by detection type (Spam ZAP, Phish ZAP, Malware ZAP). Helps track which threat categories are most frequently remediated after delivery.**" }, "customWidth": "50", "name": "postdelivery - by-detection-type heading", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "8eb38cb1-4e2d-435a-81be-e661c9b89ff4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailPostDeliveryEvents \r\n| where ActionType has \"ZAP\"\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Zapped Emails'] = coalesce(Count, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Zapped Emails", "color": "blueDark" } ] } }, "customWidth": "50", "name": "postdelivery - zap-actions trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "dd60fd71-4e14-4b38-ad22-39f1e3e3f55a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionType has \"ZAP\"\r\n| summarize [\"Spam ZAP\"]=countif(ActionType has 'Spam ZAP'), [\"Phish ZAP\"]=countif(ActionType has 'Phish ZAP'), [\"Malware ZAP\"]=countif(ActionType has 'Malware ZAP') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Spam ZAP\"]=coalesce([\"Spam ZAP\"],0), [\"Phish ZAP\"]=coalesce([\"Phish ZAP\"],0), [\"Malware ZAP\"]=coalesce([\"Malware ZAP\"],0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "customWidth": "50", "name": "postdelivery - by-detection-type trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "511f4a43-9f56-48ad-a644-b72722af82d7" }, { "type": 1, "content": { "json": "### ZAP Remediation by Destination
\r\n\r\n**This visual shows where ZAP moves malicious emails during remediation. Post-delivery actions can send emails to different locations: Quarantine (isolated for admin review), Deleted Items (soft delete), Junk Email folder, or back to Inbox (for false positive corrections). Understanding these patterns helps evaluate ZAP policy configurations and ensures malicious content is properly isolated from users.**" }, "name": "postdelivery - by-destination heading", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "dc7b9b6c-36fb-4ae4-a3e8-ff11da681c97" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the ammount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionType contains \"ZAP\"\r\n| summarize Quarantine=countif(DeliveryLocation has 'Quarantine'), ['Deleted Items']=countif(DeliveryLocation has 'Delete'), Junk=countif(DeliveryLocation has 'Junk'), Inbox=countif(DeliveryLocation has 'Inbox') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, Quarantine=coalesce(Quarantine,0), ['Deleted Items']=coalesce(['Deleted Items'],0), Junk=coalesce(Junk,0), Inbox=coalesce(Inbox,0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "name": "postdelivery - by-destination trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "cbb737ef-1c7e-4b3e-af26-a553fe6147c9" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "11" }, "name": "postdelivery - group", "styleSettings": { "showBorder": true }, "id": "e436ecee-8886-4179-a578-9e4a42e75b9e" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Quarantine Management and Insights\r\n
\r\n\r\nThis section provides comprehensive insights into quarantine operations, including release patterns, detection methods, and threat categorization. It helps security teams understand what types of threats are being quarantined and monitor quarantine release activity to identify potential false positives or security policy effectiveness.

**Recommended action:** Investigate high release rates - they indicate false positives or risky user releases; review quarantine policies and release permissions." }, "name": "quarantine - section header", "id": "c4862977-6670-4716-8109-252a361d7478" }, { "type": 1, "content": { "json": "### Quarantine Release Trend
\r\n\r\n**This visual displays the per-{Granularity} trend of emails released from quarantine by administrators. Monitoring this metric helps identify patterns in quarantine management and potential areas where policy adjustments may be needed to reduce unnecessary quarantines.**" }, "name": "quarantine - release-trend heading", "id": "8526a5e0-c6a4-44e3-b00a-5e135374f58e" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the daily ammount of emails released from quarantine\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionTrigger has \"AdminAction\" and Action has 'Quarantine release'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Quarantine Releases'] = coalesce(Count, 0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Quarantine Releases", "color": "blueDark" } ] } }, "customWidth": "100", "name": "quarantine - release trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "3625d1f1-f34a-4cbf-a78f-eb2e5506bad4" }, { "type": 1, "content": { "json": "### Quarantine Release Percentage
\r\n\r\n**Calculates the percentage of quarantined emails that were successfully released compared to the total quarantined messages. This metric helps measure engagement with quarantine and assess the effectiveness of quarantine policies.**" }, "customWidth": "40", "name": "quarantine - release-pct heading", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "e3a9502c-9030-4621-b248-55cdf69f81ae" }, { "type": 1, "content": { "json": "### Quarantine Release Analysis by Detection Type
\r\n\r\n**For each detection technology, this shows the share of its quarantined emails that were later released from quarantine (Release % = released / quarantined). A high release rate flags a detector that may be over-flagging legitimate mail - a strong candidate for policy or rule tuning. The Released count shows the volume behind each rate.**" }, "customWidth": "60", "name": "quarantine - release-by-detection heading", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "976fc90f-bf46-4315-b05e-4e501b37b869" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\r\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\r\n| where Action == \"Quarantine release\"\r\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \"Quarantine\") on NetworkMessageId\r\n| summarize count());\r\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \"Quarantine\"\r\n| summarize count());\r\nprint\r\nQuarantine_Releases = toreal(Quarantine_Releases),\r\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\r\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))", "size": 0, "showAnalytics": true, "title": " ", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "stat", "tileSettings": { "titleContent": { "columnMatch": "Release_Percentage", "formatter": 12, "formatOptions": { "palette": "none" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } }, "showBorder": true, "sortCriteriaField": "Release_Percentage", "size": "auto" }, "statSettings": { "valueField": "Release_Percentage", "valueAggregation": "None", "colorSettings": { "type": "thresholds", "mode": "foreground", "heatmapPalette": "greenRed", "thresholdsGrid": [ { "operator": "<", "thresholdValue": "5", "representation": "green" }, { "operator": ">", "thresholdValue": "5", "representation": "redDark" } ] }, "iconSettings": { "thresholdsGrid": [] }, "numberFormatSettings": { "unit": 1, "options": { "style": "decimal" } }, "tagText": "Quarantine Release Percentage", "valueFontStyle": "mega", "tagTextPosition": "bottom" } }, "customWidth": "40", "name": "quarantine - release-pct stat", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "64e157ce-2f6a-423f-9ce5-eade8b6f41d5" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Per detection technology: the share of its quarantined emails that were later released from quarantine.\r\n//Release % = released / quarantined for that detection technology - a high rate flags a detector that may be over-flagging legitimate mail (potential false positives). Detectors with fewer than 10 quarantined emails are excluded so the rate is statistically meaningful.\r\nEmailEvents\r\n| where DeliveryLocation == \"Quarantine\"\r\n| extend MDO_detection = parse_json(DetectionMethods)\r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\")\r\n| where FirstSubcategory contains \"Malware\" or FirstSubcategory contains \"Phish\" or FirstSubcategory contains \"Spam\"\r\n| join kind=leftouter (\r\n EmailPostDeliveryEvents\r\n | where Action == \"Quarantine release\"\r\n | distinct NetworkMessageId\r\n | extend ReleasedFlag = \"yes\"\r\n ) on NetworkMessageId\r\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \"yes\") by FirstSubcategory\r\n| where Quarantined >= 10 and Released > 0\r\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\r\n| project ['Detection Type']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\r\n| order by ['Release %'] desc", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Quarantined Emails", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Released", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "90px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Release %", "formatter": 4, "formatOptions": { "palette": "red", "min": 0, "max": 20, "customColumnWidthSetting": "90px" }, "numberFormat": { "unit": 1, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "60", "name": "quarantine - release-by-detection pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "9a6d21b7-7542-4ae5-8f3f-b18474b52a20" }, { "type": 1, "content": { "json": "### Malware Email Quarantine Analysis
\r\n\r\n**These visuals break down quarantined malware emails by their specific detection methods. Microsoft Defender for Office 365 employs multiple malware detection techniques including file detonation, file reputation analysis, and advanced filters. Understanding which detection methods are most frequently triggered helps optimize anti-malware policies and identify emerging malware tactics.
The line chart shows per-{Granularity} trends across all malware detection methods, while the table provides an overall distribution of detection reasons.**" }, "name": "quarantine - malware heading", "id": "59f84161-a010-44c2-aec1-b72ed98ccdff" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the ammount of malware emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has \"Malware\" and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Details = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "customWidth": "100", "name": "quarantine - malware trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "a54a8daf-0be2-4c0e-a8d7-4ff0e0879fd2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of malware emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Malware (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Malware' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Malware = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Malware)\r\n| summarize count() by Malware\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Malware, ['Detections']=count_", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Detections", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "quarantine - malware table", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "b5d0d022-cf41-47e5-ae06-cf2176b47758" }, { "type": 1, "content": { "json": "### Phishing Email Quarantine Analysis
\r\n\r\n**These visuals break down quarantined phishing emails by their specific detection methods. Microsoft Defender for Office 365 employs multiple phishing detection techniques including impersonation protection, URL detonation, spoof detection, and advanced filters. Understanding which detection methods are most frequently triggered helps optimize anti-phishing policies and identify emerging phishing tactics.
The line chart shows per-{Granularity} trends across all phishing detection methods, while the table provides an overall distribution of detection reasons.**" }, "name": "quarantine - phish heading", "id": "aca50104-cb68-4a8f-82ee-ea8eee25fe14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the ammount of phish emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has \"Phish\" and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "customWidth": "100", "name": "quarantine - phish trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "57151360-0577-45ce-8fc6-10a3790865ce" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of phish emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Phish (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Phish' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Phish = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Phish)\r\n| summarize count() by Phish\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Phish, ['Detections']=count_", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Detections", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "quarantine - phish pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "df78c64b-76f6-4980-80df-d0d432e780a5" }, { "type": 1, "content": { "json": "### Spam Email Quarantine Analysis
\r\n\r\n**These visuals provide detailed insights into quarantined spam emails categorized by detection methods. Spam detection technologies include advanced filters, general filters, bulk email filtering, reputation-based systems (IP, domain, URL), and mixed analysis detection. Analyzing spam quarantine patterns helps fine-tune spam filtering policies to balance security with user productivity and reduce false positives.
The line chart displays per-{Granularity} trends for each spam detection method, while the table shows the overall distribution.**" }, "name": "quarantine - spam heading", "id": "e131910f-0233-474a-a9b8-9f70a49246cf" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the ammount of spam emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet baseQuery = EmailEvents\r\n| where DetectionMethods has \"Spam\" and DeliveryLocation == \"Quarantine\";\r\nlet agg = materialize(baseQuery\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "customWidth": "100", "name": "quarantine - spam trend", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "5762bcc7-bbda-4a3d-91cf-de18fbdd2775" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the total ammount of spam emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Spam (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Spam' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Spam = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Spam)\r\n| summarize count() by Spam\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Spam, ['Detections']=count_", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Detections", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "30ch" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" } } } ], "filter": true } }, "customWidth": "100", "name": "quarantine - spam pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "2995f55b-17f9-458b-8630-e0370d14522a" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "11" }, "name": "quarantine - group", "id": "430294af-c68f-4427-8b55-d552a3d89d42", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "# Security Operations Center (SOC) Insights \r\n\r\n---\r\n\r\nThis tab provides a view for security operations. Combines incident response metrics with investigation insights to evaluate the effectiveness of both automated systems and manual interventions." }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "13" }, "name": "soc - tab description", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "fd65243c-514c-4813-978f-fb908226d049" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Security Incident Response Metrics\r\n
\r\n\r\n**Operational efficiency insights.** Tracks incident volume, resolution speed, automation efficacy, and classification accuracy to evaluate SOC performance.

**Recommended action:** Track mean time to close by severity against your SLA and investigate any severity trending upward." }, "name": "soc - incident-metrics section header", "id": "f92c3e24-3e0f-4f4c-8ee9-3ec60832f7b1" }, { "type": 1, "content": { "json": "### Email Security Incidents
\r\n\r\n**These visuals display the per-{Granularity} trend of email-related security incidents, as well as the proportion of email incidents compared to the total number of incidents in Defender.**" }, "name": "soc - email-incidents heading", "id": "c1cf6796-6071-4d2e-bf2c-c5e8d2a99a12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Filter for incidents that have at least one Email Security alert\r\nlet gran = {Granularity};\r\nlet OfficeEmailAlerts = SecurityAlert\r\n | where ProductName contains \"Office 365 Advanced Threat Protection\" or ProductName contains \"Microsoft 365 Defender\"\r\n | project SystemAlertId;\r\nlet agg = materialize(SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| where isnotempty(AlertIds) and not(Title startswith \"CC_\")\r\n| extend AlertId = tostring(AlertIds) \r\n| join kind=inner\r\n (OfficeEmailAlerts | extend SystemAlertId = tostring(SystemAlertId))\r\n on $left.AlertId == $right.SystemAlertId\r\n| summarize arg_max(TimeGenerated, *), AlertCount = dcount(AlertId) by IncidentNumber\r\n| summarize Incidents_Number = count() by TimeGenerated = bin(TimeGenerated, gran));\r\nrange TimeGenerated from toscalar(agg | summarize min(TimeGenerated)) to toscalar(agg | summarize max(TimeGenerated)) step gran\r\n| join kind=leftouter (agg) on TimeGenerated\r\n| project TimeGenerated, ['Email Security Incidents'] = coalesce(Incidents_Number, 0)\r\n| sort by TimeGenerated asc", "size": 0, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "chartSettings": { "seriesLabelSettings": [ { "seriesName": "Email Security Incidents", "color": "blueDark" } ] } }, "customWidth": "75", "name": "soc - email-incidents trend", "id": "e23cfcda-1017-4fd0-ac71-8a861c450f71" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Categorize incidents: Email Security vs Other\r\nlet AllAlerts = SecurityAlert\r\n | extend SystemAlertId = tostring(SystemAlertId)\r\n | project SystemAlertId, ProductName;\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| where isnotempty(AlertIds) and not(Title startswith \"CC_\")\r\n| extend AlertId = tostring(AlertIds)\r\n| join kind=inner\r\n (AllAlerts)\r\n on $left.AlertId == $right.SystemAlertId\r\n| summarize AlertSystems = make_set(ProductName) by IncidentNumber\r\n| extend HasEmailSecurity = \r\n AlertSystems has \"Office 365 Advanced Threat Protection\" or \r\n AlertSystems has \"Microsoft 365 Defender\"\r\n| extend Category = iff(HasEmailSecurity, \"Email Security\", \"Other\")\r\n| summarize IncidentCount = count() by Category\r\n", "size": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "25", "name": "soc - incident-category pie", "id": "baae2150-1b04-43b4-9713-48fd3cc6247f" }, { "type": 1, "content": { "json": "### Average Incident Time To Close (minutes)\r\n**This visual displays the average time, in minutes, to close email-related security incidents (per {Granularity}), split by severity, so you can see how resolution speed changes over time. Reference SLA targets: High 60, Medium 120, Low 240, Informational 480 minutes.**" }, "name": "soc - time-to-close heading", "id": "e23ccc6c-b0f0-407b-8e01-d8b69c40a745" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// SLA thresholds by severity for email-security (MDO) incidents\r\nlet SLA_Variables = datatable (Severity:string, TimeToResolve:int) [\r\n \"High\", 60,\r\n \"Medium\", 120,\r\n \"Low\", 240,\r\n \"Informational\", 480\r\n];\r\n\r\n// Identify MDO-related incidents via alert correlation\r\nlet EmailSecurityIncidents = \r\n SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for each MDO-related incident\r\nlet LatestMdoIncidents =\r\n SecurityIncident\r\n | summarize arg_max(TimeGenerated, Classification, Status, Severity, CreatedTime, ClosedTime, Title) by ProviderIncidentId\r\n | where ProviderIncidentId in (EmailSecurityIncidents)\r\n | where not(Title startswith \"CC_\"); // Exclude non-email incidents as needed\r\n\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| extend TimeToResolveIncident = datetime_diff('minute', ClosedTime, CreatedTime)\r\n| join kind=inner SLA_Variables on Severity\r\n| summarize\r\n ['Avg Time to Close (min)'] = avg(TimeToResolveIncident),\r\n CountIncidents = count(), Breached = countif(TimeToResolveIncident > TimeToResolve)\r\n by Day = bin(ClosedTime, 1d), Severity\r\n| order by Day asc, Severity asc", "size": 0, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "chartSettings": { "xAxis": "Day", "yAxis": [ "Avg Time to Close (min)" ], "group": "Severity", "createOtherGroup": null } }, "name": "soc - sla-by-severity trend", "id": "3f7d1f17-8d2f-4a1b-a97e-17973812ca6f" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### Closed Incident Classification (True Positive vs False Positive)\r\n\r\nThis visual shows the distribution of closed email-related incidents classified as True Positive versus False Positive. It helps assess detection accuracy and provides insight into validation trends." }, "customWidth": "33.3", "name": "soc - classification heading", "styleSettings": { "margin": "10px" }, "id": "48db10ce-8246-4f5e-8b68-f618d9c7f77c" }, { "type": 1, "content": { "json": "### True Positive Incident Classification Rate\r\n\r\nThis visual displays the percentage of email-related incidents confirmed as True Positive. It offers a clear measure of classification accuracy and highlights changes in detection effectiveness over time." }, "customWidth": "33.3", "name": "soc - tp-rate heading", "styleSettings": { "margin": "10px" }, "id": "34a84dbf-609a-407f-afef-f1592eb4a92b" }, { "type": 1, "content": { "json": "### Incidents Automated vs Manual Closure\r\n\r\nThis visual illustrates the proportion of email-related incidents closed automatically versus manually. It provides visibility into operational efficiency and the impact of automation on incident resolution.\r\n
⚠️ *You will have to review the underlying query and add any automation system specific to your organization.*" }, "customWidth": "33.3", "name": "soc - auto-vs-manual-closure heading", "styleSettings": { "margin": "10px" }, "id": "a1fd9136-7a12-4d80-b3e1-e2704a84f734" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Build a list of MDO-related incidents by cross-referencing SecurityAlert\r\nlet EmailSecurityIncidents = SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get only the most recent state of each incident, ensuring it's MDO-related\r\nlet LatestIncidents = SecurityIncident\r\n | summarize arg_max(TimeGenerated, Classification, Status, Title) by ProviderIncidentId\r\n | where ProviderIncidentId in (EmailSecurityIncidents)\r\n | where not(Title startswith \"CC_\"); // Exclude incidents unrelated to MDO (e.g., DSPM)\r\n\r\nLatestIncidents\r\n| where Status == 'Closed' // (Optional) Limit to closed/fully classified incidents\r\n| summarize Count = count() by Classification = iif(\r\n isnull(Classification) or trim(\" \", Classification) == \"\",\r\n \"Not Set\", \r\n Classification\r\n )\r\n| order by Count desc", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "33.3", "name": "soc - classification pie", "styleSettings": { "margin": "10px" }, "id": "cfa5b7c5-50cc-4b3b-8bba-1a93c57bff43" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Identify MDO-related SecurityIncident IDs via alert correlation\r\nlet EmailSecurityIncidents = \r\n SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for MDO-related incidents\r\nlet LatestMdoIncidents =\r\n SecurityIncident\r\n | summarize arg_max(TimeGenerated, Classification, Status, IncidentName) by ProviderIncidentId\r\n | where ProviderIncidentId in (EmailSecurityIncidents)\r\n // Exclude other non-email incidents (e.g., DSPM with specific naming pattern)\r\n | where not(IncidentName startswith \"CC_\");\r\n\r\n// Compute true positive rate among closed MDO incidents\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| summarize\r\n TruePositiveCount = countif(Classification == \"TruePositive\"),\r\n TotalClosed = count()\r\n| extend TruePositiveRate = iff(\r\n TotalClosed > 0,\r\n TruePositiveCount * 100.0 / TotalClosed,\r\n real(null)\r\n)", "size": 1, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "stat", "statSettings": { "valueField": "TruePositiveRate", "valueAggregation": "None", "colorSettings": { "type": "static", "mode": "background", "heatmapPalette": "greenRed", "thresholdsGrid": [] }, "iconSettings": { "thresholdsGrid": [] }, "numberFormatSettings": { "unit": 1, "options": { "style": "decimal", "maximumFractionDigits": 2 } }, "tagText": "True Positive Rate", "valueFontStyle": "xxLarge", "tagTextPosition": "bottom" } }, "customWidth": "33.3", "name": "soc - tp-rate stat", "styleSettings": { "margin": "10px" }, "id": "eca235aa-38aa-46dd-a569-74dd8f83b2f0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This queries shows the last activity on the Incident and attempts to display auto resolved incidents vs manual interaction.\r\n//Add strings for your automations if you rely on any other application/system\r\n//Fewer human-closed incidents (and a higher automated closure rate) generally indicates greater SecOps efficiency, as automation is successfully handling more work.\r\n\r\n// Identify MDO-related incidents by joining SecurityIncident and SecurityAlert\r\nlet EmailSecurityIncidents = SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get latest status of each incident and count closed incidents by who closed them\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\r\n| where ProviderIncidentId in (EmailSecurityIncidents)\r\n| where Status == 'Closed'\r\n| where not(Title startswith \"CC_\") // Exclude non-MDO incidents from DSPM policies\r\n| extend ClosedBy = iff( // Add strings for your automation systems\r\n tolower(ModifiedBy) has_any (\"system\",\"azure\",\"automation\",\"playbook\",\"microsoft xdr\",\"microsoft defender xdr\",\"created from alert\"),\r\n \"Automated\",\r\n \"Human\"\r\n )\r\n| summarize ClosedCount = count() by ClosedBy", "size": 3, "showAnalytics": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "33.3", "name": "soc - closure pie", "styleSettings": { "margin": "10px" }, "id": "a4bc160f-1ba6-4779-86cd-ef44422f1e29" } ] }, "name": "soc - incident-insights group", "id": "3083ac4d-0bdd-4db7-a5f0-0d41cb67a4eb" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "13" }, "name": "soc - incident-metrics group", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "18ff8970-e5f6-4c51-918a-aa693a45d18f" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Investigation & Response Actions\r\n
\r\n\r\n**Remediation efficacy analysis.** Compares automated (AIR) and manual admin actions to evaluate response times and investigation outcomes.\r\n

**Recommended action:** Reduce AIR pending-action latency by reviewing why approvals take long, and increase automation where it is safe to do so." }, "name": "soc - air section header", "id": "5e0b06c8-7774-4eb4-8b7f-572b3732de84" }, { "type": 1, "content": { "json": "### Automated Investigation and Response (AIR) Actions (per {Granularity})\r\n\r\nThis visual shows the per-{Granularity} trend of Automated Investigation and Response (AIR) actions, including the number of successful and failed attempts (because of prior remediation)." }, "customWidth": "100", "name": "soc - air-actions heading", "styleSettings": { "margin": "10px" }, "id": "05f14dec-e76c-413c-83a0-31a05dce65e7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query attempts to show AIR Efficiency Over Time by displaying the number of successes and failures over time\r\nEmailPostDeliveryEvents\r\n| where ActionType =~ \"Automated Remediation\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count() by bin(Timestamp, {Granularity}), ActionResult", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart", "graphSettings": { "type": 0, "topContent": { "columnMatch": "AlertId", "formatter": 1 }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "Timestamp" } }, "customWidth": "100", "name": "soc - air-efficiency trend", "styleSettings": { "margin": "10px" }, "id": "ae2a1850-5b7e-49f7-bac4-d888053ab49b" }, { "type": 1, "content": { "json": "### Automated Investigation and Response (AIR) Response Time After Email Delivery (per {Granularity})\r\n\r\nThis visual displays the average (per {Granularity}), 80th percentile (p80), 90th percentile (p90) and 99th percentile (p99) time needed, measured in minutes, from email delivery to AIR action. It serves as a SOC metric to monitor responsiveness (security team members reviewing and manually approving AIR Pending Actions) and identify potential latency in automated incident handling. If the latency is high focus on reviewing why reviwing AIR Pending Actions takes longer time for admins and consider auto-aproval of URL, Files and Email clusters. \r\n" }, "customWidth": "100", "name": "soc - air-response-time heading", "styleSettings": { "margin": "10px" }, "id": "98c66d9e-efdf-40fc-b8b0-be35d7fd97a9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// SOC metric: Daily average/p75 delay (in minutes) from email delivery to AIR action\r\nlet deliveries = EmailEvents\r\n | where DeliveryAction == \"Delivered\"// delivered emails\r\n | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n | summarize FirstDelivery = min(Timestamp) by MsgKey, Threat = tostring(ThreatTypes);\r\nlet remediations = EmailPostDeliveryEvents\r\n | where ActionType =~ \"Automated Remediation\"// automated remediation events\r\n | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n | summarize FirstRemediation = min(Timestamp) by MsgKey;\r\ndeliveries\r\n| join kind=inner remediations on MsgKey\r\n| extend DelayMinutes = datetime_diff(\"minute\", FirstRemediation, FirstDelivery)\r\n| where DelayMinutes >= 0\r\n| summarize ['Avg (min)'] = avg(DelayMinutes),\r\n ['P80 (min)'] = percentile(DelayMinutes, 80),\r\n ['P90 (min)'] = percentile(DelayMinutes, 90),\r\n ['P99 (min)'] = percentile(DelayMinutes, 99),\r\n CountEmails = count()\r\n by bin(FirstRemediation, 1d) ", "size": 0, "aggregation": 3, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "areachart", "gridSettings": { "sortBy": [ { "itemKey": "FirstRemediation", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "FirstRemediation", "sortOrder": 1 } ], "chartSettings": { "xAxis": "FirstRemediation", "yAxis": [ "P99 (min)", "P90 (min)", "P80 (min)", "Avg (min)" ], "showLegend": true } }, "customWidth": "100", "name": "soc - air-latency area", "styleSettings": { "margin": "10px" }, "id": "900383f1-6443-4d50-b15d-26e4ac11b255" }, { "type": 1, "content": { "json": "### Automated Investigation and Response (AIR) Investigation Results Trend\r\n\r\nThis visual displays the per-{Granularity} trend of AIR investigation outcomes, categorized as **Threat Detected** or **Clean**. It helps track the effectiveness of automated investigations over time and highlights patterns in threat detection." }, "customWidth": "67", "name": "soc - air-outcomes heading", "styleSettings": { "margin": "10px" }, "id": "d1cabfbe-6040-4b6e-9ce5-f48e9973dfc9" }, { "type": 1, "content": { "json": "### Investigation Actions Taken: Automated Investigation and Response (AIR) vs Manual (Human)\r\n\r\nThis visual shows whether actions taken after an Automated Investigation and Response (AIR) required manual approval by an administrator or were executed automatically. It provides insight into the level of automation versus human intervention in post-investigation remediation." }, "customWidth": "33", "name": "soc - air-auto-vs-manual heading", "styleSettings": { "margin": "10px" }, "id": "2f98514b-0172-4c4e-ba25-9a5e4138c570" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// AIR investigation outcomes by day: ThreatDetected vs. Clean\r\n\r\n// Step 1: Deduplicate automated remediation events by message and recipient\r\nlet AutoRemediations = \r\n EmailPostDeliveryEvents\r\n | where ActionType == \"Automated Remediation\"\r\n | summarize arg_max(Timestamp, ActionResult) by NetworkMessageId, RecipientEmailAddress\r\n | project NetworkMessageId, RecipientEmailAddress, Timestamp;\r\n\r\n// Step 2: Derive threat verdicts using AlertEvidence\r\nlet EvidenceVerdicts =\r\n AlertEvidence\r\n | where EntityType in (\"MailMessage\", \"MailCluster\")\r\n | extend extra = todynamic(AdditionalFields)\r\n // If this is a mail cluster, use provided NetworkMessageIds array; otherwise wrap NetworkMessageId as a single-item array\r\n | extend networkIds = iff(\r\n isnull(extra.NetworkMessageIds) or array_length(extra.NetworkMessageIds) == 0,\r\n pack_array(NetworkMessageId), // create a single-element array using pack_array\r\n extra.NetworkMessageIds // use the array as-is if it exists\r\n )\r\n | mv-expand nmID = networkIds // expand to individual message IDs\r\n // Derive verdict from LastVerdict, ThreatAnalysisSummary, and ThreatIntelligence\r\n | extend \r\n lastVerdict = tolower(tostring(extra.LastVerdict)),\r\n threatAIList = extra.ThreatAnalysisSummary,\r\n threatInt = extra.ThreatIntelligence\r\n | extend verdictFromAnalysis = iff(array_length(threatAIList) > 0, tolower(tostring(threatAIList[0].Verdict)), \"\"),\r\n verdictTI = iff(array_length(threatInt) > 0, \"malicious\", \"\") // any item in ThreatIntelligence indicates malicious\r\n // Mark as threat-detected if verdict is malicious/suspicious or threat evidence is present\r\n | extend ThreatDetectedFlag = \r\n case(\r\n lastVerdict in (\"malicious\",\"suspicious\") or verdictFromAnalysis in (\"malicious\",\"suspicious\")\r\n or verdictTI == \"malicious\",\r\n true,\r\n false\r\n )\r\n // Weight mail clusters by MailCount; default to 1 for single messages\r\n | extend MailCountInt = toint(extra.MailCount)\r\n | extend Weight = iff(EntityType == \"MailCluster\", \r\n coalesce(MailCountInt, 1), // default to 1 if MailCount is missing\r\n 1)\r\n | summarize IsThreatDetected = any(ThreatDetectedFlag), \r\n WeightSum = sum(Weight) \r\n by nmID = tostring(nmID);\r\n\r\n// Step 3: Join remediation events with verdicts and aggregate by day\r\nAutoRemediations\r\n| join kind=leftouter EvidenceVerdicts on $left.NetworkMessageId == $right.nmID\r\n| extend isThreat = coalesce(IsThreatDetected, false), \r\n effectiveWeight= coalesce(WeightSum, 1)\r\n| extend InvestigationOutcome = iif(isThreat, \"Threat Detected\", \"Clean\")\r\n| summarize PreventionCount = sum(effectiveWeight) by Day = bin(Timestamp, {Granularity}), InvestigationOutcome\r\n| order by Day asc, InvestigationOutcome asc", "size": 0, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "customWidth": "67", "name": "soc - air-outcomes trend", "styleSettings": { "margin": "10px" }, "id": "18552ccb-d8d4-45c4-a3cf-072203df9325" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query shows if the action taken after an Automated Investigation required manual approval by and admin or was automatically taken\r\nEmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionType == \"Automated Remediation\"\r\n| summarize count() by ActionTrigger", "size": 3, "showAnalytics": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "piechart" }, "customWidth": "33", "name": "soc - air-auto-vs-manual pie", "styleSettings": { "margin": "10px", "padding": "10px" }, "id": "03bc6e3c-05de-426d-91d8-b48a36b4ea74" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "### Post-Delivery Actions by Admin\r\n\r\nThis visual displays the number (per {Granularity}) of emails where an administrator performed a post-delivery action. Actions are summarized by type, including **Soft Delete**, **Hard Delete**, **Moved to Junk Folder**, **Moved to Inbox**, and **Quarantine Release**, providing insight into manual intervention trends after email delivery." }, "name": "soc - post-delivery-by-admin heading", "styleSettings": { "margin": "10px" }, "id": "a0961ca9-da58-49c4-9a1c-873c5569bed9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//This query visualises the daily ammount of emails that had an admin post delivery action, summarizing the data by action type\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionTrigger has \"AdminAction\"\r\n| summarize [\"Soft Delete\"]=countif(Action has 'Soft Delete'), [\"Hard Delete\"]=countif(Action has 'Hard Delete'), [\"Moved to junk folder\"]=countif(Action has 'Moved to junk folder'), [\"Moved to inbox\"]=countif(Action has 'Moved to inbox'), [\"Quarantine release\"]=countif(Action has 'Quarantine release') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Soft Delete\"]=coalesce([\"Soft Delete\"],0), [\"Hard Delete\"]=coalesce([\"Hard Delete\"],0), [\"Moved to junk folder\"]=coalesce([\"Moved to junk folder\"],0), [\"Moved to inbox\"]=coalesce([\"Moved to inbox\"],0), [\"Quarantine release\"]=coalesce([\"Quarantine release\"],0)\r\n| sort by Timestamp asc", "size": 0, "showAnalytics": true, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "linechart" }, "name": "soc - post-delivery-by-admin trend", "styleSettings": { "margin": "10px" }, "id": "d2ea8eac-a3db-46b0-bcb4-3abbb95ba4ad" } ] }, "customWidth": "100", "name": "soc - post-delivery group", "id": "ebca14d5-954d-4e35-a225-cb0f8a3ea81b" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "13" }, "name": "soc - air group", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "0a05394d-f813-4408-ac4d-8f481ae34c0b" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Top Malicious Email Campaigns (Clustered)\r\n
\r\n\r\n**Groups malicious inbound emails into campaigns (attack waves) using the Email Cluster ID assigned by Microsoft Defender for Office 365, showing one row per campaign with the message count, distinct recipients, sender domains, threat mix and sample subjects. Helps the SOC understand the scale and shape of coordinated attacks rather than viewing individual messages in isolation.**

**Recommended action:** Pivot on the top campaign clusters to hunt related messages and consider blocking shared sender infrastructure." }, "name": "soc - campaigns heading", "id": "d3a9e4c6-1b5f-4c8d-ae34-9f7a1b2c3d45" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Largest malicious inbound email campaigns clustered by EmailClusterId - one row per attack wave (messages, recipients, URL clicks, sender domains, threat mix, sample subjects).\r\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\r\nlet clicksByCluster = UrlClickEvents\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize UrlClicks = count() by EmailClusterId;\r\nlet qrClusters = EmailUrlInfo\r\n| where UrlLocation == \"QRCode\"\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and EmailClusterId > 0\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Messages = count(),\r\n Recipients = dcount(RecipientEmailAddress),\r\n SenderDomains = dcount(SenderFromDomain),\r\n SampleSenderDomains = make_set(SenderFromDomain, 5),\r\n ThreatTypesRaw = make_set(ThreatTypes, 50),\r\n SampleSubjects = make_set(Subject, 5),\r\n FirstSeen = min(Timestamp),\r\n LastSeen = max(Timestamp)\r\n by EmailClusterId\r\n| join kind=leftouter (clicksByCluster) on EmailClusterId\r\n| extend UrlClicks = coalesce(UrlClicks, 0)\r\n| join kind=leftouter (qrClusters) on EmailClusterId\r\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \"QR code\", \"\")\r\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \", \"), \", \"), dynamic([])))\r\n| top 20 by Messages\r\n| project ['Email Cluster ID']=EmailClusterId, ['Messages']=Messages, ['Recipients']=Recipients, ['URL Clicks']=UrlClicks, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen", "size": 0, "title": "", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "Messages", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Recipients", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "URL Clicks", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] } }, "name": "soc - campaigns table", "id": "a2a391e1-0e26-4e0e-a8d3-26e3c7132079" }, { "type": 1, "content": { "json": "\r\n\r\n\r\n\r\n
Most-Clicked Email Campaigns (Recipient Engagement)\r\n
\r\n\r\n**Ranks malicious inbound campaigns by recipient URL clicks, surfacing the attack waves that reached a mailbox and drew engagement regardless of raw message volume. The highest-volume campaigns are usually quarantined before delivery, so the clusters that draw clicks are often smaller, targeted waves. A non-zero URL Clicks count means a recipient opened a URL within the campaign's messages. Because attackers often mix legitimate URLs with malicious ones to build credibility, and a per-URL threat verdict is not available here, treat these as clicks on potentially malicious URLs that warrant review rather than confirmed malicious clicks.**

**Recommended action:** Focus on these clusters for user follow-up (awareness and, where credentials may be exposed, password reset) and hunt for related messages sharing sender infrastructure." }, "name": "soc - mostclicked heading", "id": "e9e41b47-0434-42e5-8b04-4170ab061b81" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Malicious inbound campaigns ranked by recipient URL clicks - the attack waves that reached a mailbox and drew engagement, regardless of message volume.\r\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\r\nlet clicksByCluster = UrlClickEvents\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize UrlClicks = count() by EmailClusterId;\r\nlet qrClusters = EmailUrlInfo\r\n| where UrlLocation == \"QRCode\"\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and EmailClusterId > 0\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Messages = count(),\r\n Recipients = dcount(RecipientEmailAddress),\r\n SenderDomains = dcount(SenderFromDomain),\r\n SampleSenderDomains = make_set(SenderFromDomain, 5),\r\n ThreatTypesRaw = make_set(ThreatTypes, 50),\r\n SampleSubjects = make_set(Subject, 5),\r\n FirstSeen = min(Timestamp),\r\n LastSeen = max(Timestamp)\r\n by EmailClusterId\r\n| join kind=inner (clicksByCluster) on EmailClusterId\r\n| where UrlClicks > 0\r\n| join kind=leftouter (qrClusters) on EmailClusterId\r\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \"QR code\", \"\")\r\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \", \"), \", \"), dynamic([])))\r\n| top 20 by UrlClicks\r\n| project ['Email Cluster ID']=EmailClusterId, ['URL Clicks']=UrlClicks, ['Messages']=Messages, ['Recipients']=Recipients, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen", "size": 0, "title": "", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "filter": true, "formatters": [ { "columnMatch": "URL Clicks", "formatter": 3, "formatOptions": { "palette": "redDark", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Messages", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } }, { "columnMatch": "Recipients", "formatter": 3, "formatOptions": { "palette": "blue", "customColumnWidthSetting": "130px" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 1 } } } ] } }, "name": "soc - mostclicked table", "id": "1ffe8f97-ad79-47d9-9598-dd73ee54cd8d" } ] }, "conditionalVisibility": { "parameterName": "Tab", "comparison": "isEqualTo", "value": "13" }, "name": "soc - campaigns group", "styleSettings": { "margin": "10px", "padding": "10px", "showBorder": true }, "id": "b8f2a1c4-5d6e-4a7b-9c8d-0e1f2a3b4c5d" } ], "isLocked": true, "fallbackResourceIds": [], "fromTemplateId": "sentinel-MicrosoftDefenderForOffice365detectionsandinsights" }