KQL Library / Email & Phishing
Email & Phishing
top-blocked-malware-email-events.kql
Top blocked malware email events. Does what it says on the tin.
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Does exactly what it says on the tin
EmailEvents
| where ThreatTypes has "Malware"
| summarize MalwareEmailsQuarantined = count() by bin(Timestamp, 1d), RecipientEmailAddress, SenderFromDomain
| order by Timestamp desc