diff --git a/Solutions/Microsoft Defender XDR/Data/Solution_Microsoft Defender XDR.json b/Solutions/Microsoft Defender XDR/Data/Solution_Microsoft Defender XDR.json index b885e61138a..3297c4eb82c 100644 --- a/Solutions/Microsoft Defender XDR/Data/Solution_Microsoft Defender XDR.json +++ b/Solutions/Microsoft Defender XDR/Data/Solution_Microsoft Defender XDR.json @@ -443,7 +443,7 @@ "Workbooks/MicrosoftDefenderForIdentity.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Microsoft Defender XDR", - "Version": "3.2.1", + "Version": "3.2.2", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "StaticDataConnectorIds": [ diff --git a/Solutions/Microsoft Defender XDR/Package/3.2.2.zip b/Solutions/Microsoft Defender XDR/Package/3.2.2.zip new file mode 100644 index 00000000000..237a30f7cf2 Binary files /dev/null and b/Solutions/Microsoft Defender XDR/Package/3.2.2.zip differ diff --git a/Solutions/Microsoft Defender XDR/Package/mainTemplate.json b/Solutions/Microsoft Defender XDR/Package/mainTemplate.json index 1b0a946dcd3..994823afdd2 100644 --- a/Solutions/Microsoft Defender XDR/Package/mainTemplate.json +++ b/Solutions/Microsoft Defender XDR/Package/mainTemplate.json @@ -92,7 +92,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Microsoft Defender XDR", - "_solutionVersion": "3.2.1", + "_solutionVersion": "3.2.2", "solutionId": "azuresentinel.azure-sentinel-solution-microsoft365defender", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "MicrosoftThreatProtection", @@ -2351,7 +2351,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Defender XDR data connector with template version 3.2.1", + "description": "Microsoft Defender XDR data connector with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -2855,7 +2855,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PossiblePhishingwithCSL&NetworkSession_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "PossiblePhishingwithCSL&NetworkSession_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -2975,6 +2975,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "InitiatingProcessAccountUpn", @@ -2988,10 +2989,10 @@ "columnName": "InitiatingProcessAccountDomain", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "RecipientEmailAddress", @@ -3005,10 +3006,10 @@ "columnName": "RecipientEmailUPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -3022,26 +3023,25 @@ "columnName": "HostNameDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "SourceIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "DestinationIP", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -3098,7 +3098,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SUNSPOTHashes_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "SUNSPOTHashes_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -3141,6 +3141,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -3154,10 +3155,10 @@ "columnName": "HostNameDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "InitiatingProcessAccountUpn", @@ -3171,8 +3172,7 @@ "columnName": "InitiatingProcessAccountDomain", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -3229,7 +3229,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PotentialBuildProcessCompromiseMDE_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "PotentialBuildProcessCompromiseMDE_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -3272,6 +3272,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "HostName", @@ -3281,10 +3282,10 @@ "columnName": "HostNameDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "FileEditUpn", @@ -3298,8 +3299,7 @@ "columnName": "FileEditDomain", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -3356,7 +3356,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SolarWinds_TEARDROP_Process-IOCs_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "SolarWinds_TEARDROP_Process-IOCs_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -3402,6 +3402,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -3415,10 +3416,10 @@ "columnName": "HostNameDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "InitiatingProcessAccountUpn", @@ -3432,10 +3433,10 @@ "columnName": "InitiatingProcessAccountDomain", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "FileHash", "fieldMappings": [ { "columnName": "HashAlgorithm", @@ -3445,8 +3446,7 @@ "columnName": "InitiatingProcessSHA1", "identifier": "Value" } - ], - "entityType": "FileHash" + ] } ] } @@ -3503,7 +3503,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SolarWinds_SUNBURST_Network-IOCs_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "SolarWinds_SUNBURST_Network-IOCs_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -3549,6 +3549,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -3562,10 +3563,10 @@ "columnName": "HostNameDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "InitiatingProcessAccountUpn", @@ -3579,28 +3580,28 @@ "columnName": "InitiatingProcessAccountDomain", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "RemoteIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "RemoteUrl", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "FileHash", "fieldMappings": [ { "columnName": "HashAlgorithm", @@ -3610,8 +3611,7 @@ "columnName": "InitiatingProcessMD5", "identifier": "Value" } - ], - "entityType": "FileHash" + ] } ] } @@ -3668,7 +3668,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SolarWinds_SUNBURST_&_SUPERNOVA_File-IOCs_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "SolarWinds_SUNBURST_&_SUPERNOVA_File-IOCs_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -3714,6 +3714,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -3727,10 +3728,10 @@ "columnName": "HostNameDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "InitiatingProcessAccountUpn", @@ -3744,10 +3745,10 @@ "columnName": "InitiatingProcessAccountDomain", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "FileHash", "fieldMappings": [ { "columnName": "HashAlgorithm", @@ -3757,8 +3758,7 @@ "columnName": "MD5", "identifier": "Value" } - ], - "entityType": "FileHash" + ] } ] } @@ -3815,7 +3815,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AVdetectionsrelatedtoUkrainebasedthreats_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "AVdetectionsrelatedtoUkrainebasedthreats_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -3857,6 +3857,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "CompromisedEntity", @@ -3870,8 +3871,7 @@ "columnName": "HostNameDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] } ] } @@ -3928,7 +3928,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AVTarrask_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "AVTarrask_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -3970,6 +3970,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "CompromisedEntity", @@ -3983,17 +3984,16 @@ "columnName": "HostNameDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "PublicIP", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -4050,7 +4050,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AVSpringShell_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "AVSpringShell_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -4092,6 +4092,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "CompromisedEntity", @@ -4105,17 +4106,16 @@ "columnName": "HostNameDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "PublicIP", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -4172,7 +4172,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PossibleWebpBufferOverflow_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "PossibleWebpBufferOverflow_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -4217,6 +4217,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -4230,10 +4231,10 @@ "columnName": "HostNameDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "AccountUpn", @@ -4247,44 +4248,43 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "LocalIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "Process", "fieldMappings": [ { "columnName": "ProcessId", "identifier": "ProcessId" } - ], - "entityType": "Process" + ] }, { + "entityType": "Process", "fieldMappings": [ { "columnName": "InitiatingProcessId", "identifier": "ProcessId" } - ], - "entityType": "Process" + ] }, { + "entityType": "Process", "fieldMappings": [ { "columnName": "ProcessCommandLine", "identifier": "CommandLine" } - ], - "entityType": "Process" + ] } ], "eventGroupingSettings": { @@ -4297,13 +4297,13 @@ "incidentConfiguration": { "createIncident": false, "groupingConfiguration": { - "lookbackDuration": "PT5H", + "reopenClosedIncident": false, "matchingMethod": "Selected", "enabled": false, + "lookbackDuration": "PT5H", "groupByEntities": [ "Account" - ], - "reopenClosedIncident": false + ] } } } @@ -4360,7 +4360,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DeimosComponentExecution_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "DeimosComponentExecution_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]", @@ -4406,6 +4406,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -4419,8 +4420,7 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] } ] } @@ -4477,7 +4477,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ImminentRansomware_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "ImminentRansomware_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]", @@ -4514,6 +4514,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "Dvc", @@ -4527,8 +4528,7 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] } ] } @@ -4585,7 +4585,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MaliciousCMDExecutionByJava_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "MaliciousCMDExecutionByJava_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]", @@ -4627,6 +4627,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -4640,8 +4641,7 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] } ] } @@ -4698,7 +4698,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "C2-NamedPipe_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "C2-NamedPipe_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]", @@ -4740,6 +4740,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -4753,8 +4754,7 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] } ] } @@ -4811,7 +4811,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DoppelPaymerProcDump_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "DoppelPaymerProcDump_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject15').analyticRuleVersion15]", @@ -4853,6 +4853,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -4866,8 +4867,7 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] } ] } @@ -4924,7 +4924,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "LSASSCredDumpProcdump_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "LSASSCredDumpProcdump_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject16').analyticRuleVersion16]", @@ -4966,6 +4966,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -4979,8 +4980,7 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] } ] } @@ -5037,7 +5037,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DoppelpaymerStopService_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "DoppelpaymerStopService_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject17').analyticRuleVersion17]", @@ -5081,6 +5081,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -5094,8 +5095,7 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] } ] } @@ -5152,7 +5152,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "QakbotCampaignSelfDeletion_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "QakbotCampaignSelfDeletion_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject18').analyticRuleVersion18]", @@ -5194,6 +5194,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -5207,8 +5208,7 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] } ] } @@ -5265,7 +5265,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Regsvr32Rundll32ImageLoadsAbnormalExtension_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "Regsvr32Rundll32ImageLoadsAbnormalExtension_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject19').analyticRuleVersion19]", @@ -5313,6 +5313,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -5326,35 +5327,34 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "LocalIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "RemoteIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "RemoteUrl", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -5411,7 +5411,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Regsvr32Rundll32WithAnomalousParentProcess_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "Regsvr32Rundll32WithAnomalousParentProcess_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject20').analyticRuleVersion20]", @@ -5459,6 +5459,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -5472,35 +5473,34 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "LocalIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "RemoteIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "RemoteUrl", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -5557,7 +5557,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousCommandInitiatedByWebServerProcess_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "SuspiciousCommandInitiatedByWebServerProcess_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject21').analyticRuleVersion21]", @@ -5604,6 +5604,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -5617,8 +5618,7 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] } ] } @@ -5675,7 +5675,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BITSAdminActivity_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "BITSAdminActivity_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject22').analyticRuleVersion22]", @@ -5721,6 +5721,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -5734,10 +5735,10 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Process", "fieldMappings": [ { "columnName": "ProcessId", @@ -5747,8 +5748,7 @@ "columnName": "ProcessCommandLine", "identifier": "CommandLine" } - ], - "entityType": "Process" + ] } ] } @@ -5805,7 +5805,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "OfficeAppsLaunchingWscript_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "OfficeAppsLaunchingWscript_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject23').analyticRuleVersion23]", @@ -5851,6 +5851,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -5864,10 +5865,10 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Process", "fieldMappings": [ { "columnName": "ProcessId", @@ -5877,8 +5878,7 @@ "columnName": "ProcessCommandLine", "identifier": "CommandLine" } - ], - "entityType": "Process" + ] } ] } @@ -5935,7 +5935,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PotentialKerberoastActivities_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "PotentialKerberoastActivities_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject24').analyticRuleVersion24]", @@ -5980,6 +5980,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -5993,10 +5994,10 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "AccountUpn", @@ -6010,8 +6011,7 @@ "columnName": "AccountName", "identifier": "Name" } - ], - "entityType": "Account" + ] } ] } @@ -6068,7 +6068,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FilesCopiedToUSBDrives_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "FilesCopiedToUSBDrives_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject25').analyticRuleVersion25]", @@ -6111,6 +6111,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -6124,10 +6125,10 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "File", "fieldMappings": [ { "columnName": "FileName", @@ -6137,10 +6138,10 @@ "columnName": "FolderPath", "identifier": "Directory" } - ], - "entityType": "File" + ] }, { + "entityType": "FileHash", "fieldMappings": [ { "columnName": "FileHashAlgorithm", @@ -6150,8 +6151,7 @@ "columnName": "SHA256", "identifier": "Value" } - ], - "entityType": "FileHash" + ] } ] } @@ -6208,7 +6208,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MosaicLoader_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "MosaicLoader_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject26').analyticRuleVersion26]", @@ -6250,6 +6250,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -6263,10 +6264,10 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "RegistryValue", "fieldMappings": [ { "columnName": "RegistryValueName", @@ -6276,8 +6277,7 @@ "columnName": "RegistryValueData", "identifier": "Value" } - ], - "entityType": "RegistryValue" + ] } ] } @@ -6334,7 +6334,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AnomalousVoulmeOfFileDeletion_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "AnomalousVoulmeOfFileDeletion_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject27').analyticRuleVersion27]", @@ -6383,15 +6383,16 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "UserId", "identifier": "AadUserId" } - ], - "entityType": "Account" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "Name", @@ -6401,17 +6402,16 @@ "columnName": "NTDomain", "identifier": "NTDomain" } - ], - "entityType": "Account" + ] }, { + "entityType": "CloudApplication", "fieldMappings": [ { "columnName": "ApplicationId", "identifier": "AppId" } - ], - "entityType": "CloudApplication" + ] } ], "customDetails": { @@ -6471,7 +6471,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "RemoteFileCreationWithPsExec_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "RemoteFileCreationWithPsExec_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject28').analyticRuleVersion28]", @@ -6513,6 +6513,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -6526,8 +6527,7 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] } ] } @@ -6584,7 +6584,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ServiceAccountsPerformingRemotePS_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "ServiceAccountsPerformingRemotePS_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject29').analyticRuleVersion29]", @@ -6627,6 +6627,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -6640,10 +6641,10 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "AccountName", @@ -6657,8 +6658,7 @@ "columnName": "AccountName", "identifier": "Name" } - ], - "entityType": "Account" + ] } ] } @@ -6715,7 +6715,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AccountCreation_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "AccountCreation_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject30').analyticRuleVersion30]", @@ -6757,6 +6757,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -6770,10 +6771,10 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Process", "fieldMappings": [ { "columnName": "ProcessId", @@ -6783,8 +6784,7 @@ "columnName": "ProcessCommandLine", "identifier": "CommandLine" } - ], - "entityType": "Process" + ] } ] } @@ -6841,7 +6841,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "LocalAdminGroupChanges_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "LocalAdminGroupChanges_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject31').analyticRuleVersion31]", @@ -6884,6 +6884,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -6897,10 +6898,10 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "UserAdded", @@ -6914,8 +6915,7 @@ "columnName": "laccountdomain", "identifier": "NTDomain" } - ], - "entityType": "Account" + ] } ] } @@ -6972,7 +6972,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "RareProcessAsService_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "RareProcessAsService_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject32').analyticRuleVersion32]", @@ -7021,6 +7021,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -7034,10 +7035,10 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Process", "fieldMappings": [ { "columnName": "ServiceProcessID", @@ -7047,8 +7048,7 @@ "columnName": "ServiceProcessCmdline", "identifier": "CommandLine" } - ], - "entityType": "Process" + ] } ] } @@ -7105,7 +7105,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DisableSecurityServiceViaRegistry_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "DisableSecurityServiceViaRegistry_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject33').analyticRuleVersion33]", @@ -7147,6 +7147,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -7160,10 +7161,10 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "AccountUpn", @@ -7177,10 +7178,10 @@ "columnName": "AccountDomain", "identifier": "NTDomain" } - ], - "entityType": "Account" + ] }, { + "entityType": "Process", "fieldMappings": [ { "columnName": "ProcessId", @@ -7190,8 +7191,7 @@ "columnName": "ProcessCommandLine", "identifier": "CommandLine" } - ], - "entityType": "Process" + ] } ] } @@ -7248,7 +7248,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DataDeletionOnMulipleDrivesUsingCipherExe_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "DataDeletionOnMulipleDrivesUsingCipherExe_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject34').analyticRuleVersion34]", @@ -7290,6 +7290,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -7303,8 +7304,7 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] } ] } @@ -7361,7 +7361,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "LaZagneCredTheft_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "LaZagneCredTheft_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject35').analyticRuleVersion35]", @@ -7403,6 +7403,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -7416,10 +7417,10 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Process", "fieldMappings": [ { "columnName": "ProcessId", @@ -7429,8 +7430,7 @@ "columnName": "ProcessCommandLine", "identifier": "CommandLine" } - ], - "entityType": "Process" + ] } ] } @@ -7487,7 +7487,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "LogDeletionUsingWevtutil_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "LogDeletionUsingWevtutil_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject36').analyticRuleVersion36]", @@ -7529,6 +7529,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -7542,8 +7543,7 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] } ] } @@ -7600,7 +7600,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MultiProcessKillWithTaskKill_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "MultiProcessKillWithTaskKill_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject37').analyticRuleVersion37]", @@ -7642,6 +7642,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -7655,8 +7656,7 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] } ] } @@ -7713,7 +7713,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PotentialCobaltStrikeRansomwareActivity_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "PotentialCobaltStrikeRansomwareActivity_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject38').analyticRuleVersion38]", @@ -7763,6 +7763,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -7776,10 +7777,10 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "AccountFullName", @@ -7793,17 +7794,16 @@ "columnName": "AccountDomain", "identifier": "DnsDomain" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "RemoteIP", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -7860,7 +7860,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "QakbotDiscoveryActivities_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "QakbotDiscoveryActivities_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject39').analyticRuleVersion39]", @@ -7906,6 +7906,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -7919,8 +7920,7 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] } ] } @@ -7977,7 +7977,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ShadowCopyDeletion_AnalyticalRules Analytics Rule with template version 3.2.1", + "description": "ShadowCopyDeletion_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject40').analyticRuleVersion40]", @@ -8019,6 +8019,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -8032,10 +8033,10 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "AccountUpn", @@ -8049,10 +8050,10 @@ "columnName": "AccountDomain", "identifier": "DnsDomain" } - ], - "entityType": "Account" + ] }, { + "entityType": "Process", "fieldMappings": [ { "columnName": "ProcessId", @@ -8062,8 +8063,7 @@ "columnName": "ProcessCommandLine", "identifier": "CommandLine" } - ], - "entityType": "Process" + ] } ] } @@ -8120,7 +8120,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Appspot Phishing Abuse_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Appspot Phishing Abuse_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -8206,7 +8206,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PayloadDropUsingCertUtil_HuntingQueries Hunting Query with template version 3.2.1", + "description": "PayloadDropUsingCertUtil_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -8288,7 +8288,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "JudgementPandaExfilActivity_HuntingQueries Hunting Query with template version 3.2.1", + "description": "JudgementPandaExfilActivity_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -8374,7 +8374,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DeimosComponentExecution_HuntingQueries Hunting Query with template version 3.2.1", + "description": "DeimosComponentExecution_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -8456,7 +8456,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "LemonDuckRegistrationFunction_HuntingQueries Hunting Query with template version 3.2.1", + "description": "LemonDuckRegistrationFunction_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -8538,7 +8538,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DeviceWithLog4jAlerts_HuntingQueries Hunting Query with template version 3.2.1", + "description": "DeviceWithLog4jAlerts_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", @@ -8620,7 +8620,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Log4jVulnRelatedAlerts_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Log4jVulnRelatedAlerts_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", @@ -8702,7 +8702,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ImminentRansomware_HuntingQueries Hunting Query with template version 3.2.1", + "description": "ImminentRansomware_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]", @@ -8784,7 +8784,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MaliciousUseOfMSBuildAsLoLBin_HuntingQueries Hunting Query with template version 3.2.1", + "description": "MaliciousUseOfMSBuildAsLoLBin_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]", @@ -8866,7 +8866,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "QakbotReconActivities_HuntingQueries Hunting Query with template version 3.2.1", + "description": "QakbotReconActivities_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]", @@ -8948,7 +8948,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "RobbinhoodDriver_HuntingQueries Hunting Query with template version 3.2.1", + "description": "RobbinhoodDriver_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject11').huntingQueryVersion11]", @@ -9030,7 +9030,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Snip3MaliciousNetworkConnectivity_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Snip3MaliciousNetworkConnectivity_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject12').huntingQueryVersion12]", @@ -9112,7 +9112,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MaliciousCMDExecutionByJava_HuntingQueries Hunting Query with template version 3.2.1", + "description": "MaliciousCMDExecutionByJava_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject13').huntingQueryVersion13]", @@ -9194,7 +9194,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Check for spoofing attempts on the domain with Authentication failures_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Check for spoofing attempts on the domain with Authentication failures_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject14').huntingQueryVersion14]", @@ -9280,7 +9280,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "C2-NamedPipe_HuntingQueries Hunting Query with template version 3.2.1", + "description": "C2-NamedPipe_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject15').huntingQueryVersion15]", @@ -9362,7 +9362,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ReconWithRundll_HuntingQueries Hunting Query with template version 3.2.1", + "description": "ReconWithRundll_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject16').huntingQueryVersion16]", @@ -9444,7 +9444,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DoppelPaymerProcdump_HuntingQueries Hunting Query with template version 3.2.1", + "description": "DoppelPaymerProcdump_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject17').huntingQueryVersion17]", @@ -9526,7 +9526,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "LaZagne_HuntingQueries Hunting Query with template version 3.2.1", + "description": "LaZagne_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject18').huntingQueryVersion18]", @@ -9608,7 +9608,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "LSASSCredDumpProcdump_HuntingQueries Hunting Query with template version 3.2.1", + "description": "LSASSCredDumpProcdump_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject19').huntingQueryVersion19]", @@ -9690,7 +9690,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClearSystemLogs_HuntingQueries Hunting Query with template version 3.2.1", + "description": "ClearSystemLogs_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject20').huntingQueryVersion20]", @@ -9772,7 +9772,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DoppelpaymerStopServices_HuntingQueries Hunting Query with template version 3.2.1", + "description": "DoppelpaymerStopServices_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject21').huntingQueryVersion21]", @@ -9854,7 +9854,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "QakbotCampaignSelfDeletion_HuntingQueries Hunting Query with template version 3.2.1", + "description": "QakbotCampaignSelfDeletion_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject22').huntingQueryVersion22]", @@ -9936,7 +9936,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Regsvr32Rundll32ImageLoadsAbnormalExtension_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Regsvr32Rundll32ImageLoadsAbnormalExtension_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject23').huntingQueryVersion23]", @@ -10022,7 +10022,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Regsvr32Rundll32WithAnomalousParentProcess_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Regsvr32Rundll32WithAnomalousParentProcess_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject24').huntingQueryVersion24]", @@ -10108,7 +10108,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Delivered Bad Emails from Top bad IPv4 addresses_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Delivered Bad Emails from Top bad IPv4 addresses_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject25').huntingQueryVersion25]", @@ -10194,7 +10194,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousCommandInitiatedByWebServerProcess_HuntingQueries Hunting Query with template version 3.2.1", + "description": "SuspiciousCommandInitiatedByWebServerProcess_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject26').huntingQueryVersion26]", @@ -10276,7 +10276,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User&GroupEnumWithNetCommand_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User&GroupEnumWithNetCommand_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject27').huntingQueryVersion27]", @@ -10354,7 +10354,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ATP policy status check_HuntingQueries Hunting Query with template version 3.2.1", + "description": "ATP policy status check_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject28').huntingQueryVersion28]", @@ -10440,7 +10440,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "JNLP attachment_HuntingQueries Hunting Query with template version 3.2.1", + "description": "JNLP attachment_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject29').huntingQueryVersion29]", @@ -10526,7 +10526,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Safe attachment detection_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Safe attachment detection_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject30').huntingQueryVersion30]", @@ -10612,7 +10612,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Authentication failures_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Authentication failures_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject31').huntingQueryVersion31]", @@ -10698,7 +10698,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CompAuth Failure Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "CompAuth Failure Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject32').huntingQueryVersion32]", @@ -10784,7 +10784,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DKIM Failure Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "DKIM Failure Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject33').huntingQueryVersion33]", @@ -10870,7 +10870,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DMARC Failure Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "DMARC Failure Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject34').huntingQueryVersion34]", @@ -10956,7 +10956,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SPF Failure Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "SPF Failure Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject35').huntingQueryVersion35]", @@ -11042,7 +11042,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spoof attempts with auth failure_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spoof attempts with auth failure_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject36').huntingQueryVersion36]", @@ -11128,7 +11128,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Spoof detections by Sender Domain_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Spoof detections by Sender Domain_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject37').huntingQueryVersion37]", @@ -11214,7 +11214,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Spoof DMARC detections by Sender Domain_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Spoof DMARC detections by Sender Domain_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject38').huntingQueryVersion38]", @@ -11300,7 +11300,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Spoof Intra-Org detections by SenderDomain_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Spoof Intra-Org detections by SenderDomain_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject39').huntingQueryVersion39]", @@ -11386,7 +11386,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Message from Accepted Domain with DMARC TempError_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Message from Accepted Domain with DMARC TempError_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject40').huntingQueryVersion40]", @@ -11472,7 +11472,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Message with URL listed on OpenPhish delivered into Inbox_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Message with URL listed on OpenPhish delivered into Inbox_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject41').huntingQueryVersion41]", @@ -11558,7 +11558,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Potential OAuth phishing email delivered into Inbox_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Potential OAuth phishing email delivered into Inbox_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject42').huntingQueryVersion42]", @@ -11644,7 +11644,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Potentially malicious SVG file delivered into Inbox_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Potentially malicious SVG file delivered into Inbox_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject43').huntingQueryVersion43]", @@ -11730,7 +11730,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Audit Email Preview-Download action_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Audit Email Preview-Download action_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject44').huntingQueryVersion44]", @@ -11816,7 +11816,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Bad email percentage - Inbound emails_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Bad email percentage - Inbound emails_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject45').huntingQueryVersion45]", @@ -11902,7 +11902,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Calculate MDO Efficacy_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Calculate MDO Efficacy_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject46').huntingQueryVersion46]", @@ -11988,7 +11988,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Email sender IP address Geo location information_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Email sender IP address Geo location information_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject47').huntingQueryVersion47]", @@ -12074,7 +12074,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Hunt for Admin email access_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Hunt for Admin email access_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject48').huntingQueryVersion48]", @@ -12160,7 +12160,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Hunt for TABL changes_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Hunt for TABL changes_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject49').huntingQueryVersion49]", @@ -12246,7 +12246,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Local time to UTC time conversion_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Local time to UTC time conversion_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject50').huntingQueryVersion50]", @@ -12332,7 +12332,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mail item accessed_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Mail item accessed_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject51').huntingQueryVersion51]", @@ -12418,7 +12418,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malicious email senders_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malicious email senders_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject52').huntingQueryVersion52]", @@ -12504,7 +12504,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MDO daily detection summary report_HuntingQueries Hunting Query with template version 3.2.1", + "description": "MDO daily detection summary report_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject53').huntingQueryVersion53]", @@ -12590,7 +12590,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "New TABL Items_HuntingQueries Hunting Query with template version 3.2.1", + "description": "New TABL Items_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject54').huntingQueryVersion54]", @@ -12676,7 +12676,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 Domains sending Malicious Emails (Malware+Phish+Spam)_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 Domains sending Malicious Emails (Malware+Phish+Spam)_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject55').huntingQueryVersion55]", @@ -12762,7 +12762,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 External Senders (Malware)_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 External Senders (Malware)_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject56').huntingQueryVersion56]", @@ -12848,7 +12848,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 External Senders (Phish)_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 External Senders (Phish)_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject57').huntingQueryVersion57]", @@ -12934,7 +12934,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 External Senders (Spam)_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 External Senders (Spam)_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject58').huntingQueryVersion58]", @@ -13020,7 +13020,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 External Senders_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 External Senders_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject59').huntingQueryVersion59]", @@ -13106,7 +13106,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 Targeted Users (Malware+Phish+Spam)_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 Targeted Users (Malware+Phish+Spam)_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject60').huntingQueryVersion60]", @@ -13192,7 +13192,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam)_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 Users clicking on Malicious URLs (Malware+Phish+Spam)_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject61').huntingQueryVersion61]", @@ -13278,7 +13278,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Total number of detections by MDO over time_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Total number of detections by MDO over time_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject62').huntingQueryVersion62]", @@ -13364,7 +13364,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Total number of detections by MDO_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Total number of detections by MDO_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject63').huntingQueryVersion63]", @@ -13450,7 +13450,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Automated email notifications and suspicious sign-in activity_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Automated email notifications and suspicious sign-in activity_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject64').huntingQueryVersion64]", @@ -13536,7 +13536,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BEC - File sharing tactics - Dropbox_HuntingQueries Hunting Query with template version 3.2.1", + "description": "BEC - File sharing tactics - Dropbox_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject65').huntingQueryVersion65]", @@ -13622,7 +13622,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BEC - File sharing tactics - OneDrive or SharePoint_HuntingQueries Hunting Query with template version 3.2.1", + "description": "BEC - File sharing tactics - OneDrive or SharePoint_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject66').huntingQueryVersion66]", @@ -13708,7 +13708,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Email bombing_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Email bombing_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject67').huntingQueryVersion67]", @@ -13790,7 +13790,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Emails containing links to IP addresses_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Emails containing links to IP addresses_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject68').huntingQueryVersion68]", @@ -13876,7 +13876,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Files share contents and suspicious sign-in activity_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Files share contents and suspicious sign-in activity_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject69').huntingQueryVersion69]", @@ -13962,7 +13962,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Good emails from senders with bad patterns_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Good emails from senders with bad patterns_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject70').huntingQueryVersion70]", @@ -14048,7 +14048,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Hunt for email bombing attacks_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Hunt for email bombing attacks_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject71').huntingQueryVersion71]", @@ -14134,7 +14134,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Hunt for email conversation take over attempts_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Hunt for email conversation take over attempts_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject72').huntingQueryVersion72]", @@ -14220,7 +14220,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Hunt for malicious attachments using external IOC source_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Hunt for malicious attachments using external IOC source_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject73').huntingQueryVersion73]", @@ -14306,7 +14306,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Hunt for malicious URLs using external IOC source_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Hunt for malicious URLs using external IOC source_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject74').huntingQueryVersion74]", @@ -14392,7 +14392,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Inbox rule change which forward-redirect email_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Inbox rule change which forward-redirect email_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject75').huntingQueryVersion75]", @@ -14478,7 +14478,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MDO_CountOfRecipientsEmailaddressbySubject_HuntingQueries Hunting Query with template version 3.2.1", + "description": "MDO_CountOfRecipientsEmailaddressbySubject_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject76').huntingQueryVersion76]", @@ -14564,7 +14564,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MDO_Countofrecipientsemailaddressesbysubject_HuntingQueries Hunting Query with template version 3.2.1", + "description": "MDO_Countofrecipientsemailaddressesbysubject_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject77').huntingQueryVersion77]", @@ -14650,7 +14650,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MDO_CountOfSendersEmailaddressbySubject_HuntingQueries Hunting Query with template version 3.2.1", + "description": "MDO_CountOfSendersEmailaddressbySubject_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject78').huntingQueryVersion78]", @@ -14736,7 +14736,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MDO_SummaryOfSenders_HuntingQueries Hunting Query with template version 3.2.1", + "description": "MDO_SummaryOfSenders_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject79').huntingQueryVersion79]", @@ -14822,7 +14822,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MDO_URLClickedinEmail_HuntingQueries Hunting Query with template version 3.2.1", + "description": "MDO_URLClickedinEmail_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject80').huntingQueryVersion80]", @@ -14908,7 +14908,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top outbound recipient domains sending inbound emails with threats_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top outbound recipient domains sending inbound emails with threats_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject81').huntingQueryVersion81]", @@ -14994,7 +14994,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Detections by detection methods_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Detections by detection methods_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject82').huntingQueryVersion82]", @@ -15080,7 +15080,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mail reply to new domain_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Mail reply to new domain_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject83').huntingQueryVersion83]", @@ -15166,7 +15166,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mailflow by directionality_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Mailflow by directionality_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject84').huntingQueryVersion84]", @@ -15252,7 +15252,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malicious emails detected per day_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malicious emails detected per day_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject85').huntingQueryVersion85]", @@ -15338,7 +15338,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Sender recipient contact establishment_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Sender recipient contact establishment_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject86').huntingQueryVersion86]", @@ -15424,7 +15424,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spam Detections by Delivery Location - High_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spam Detections by Delivery Location - High_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject87').huntingQueryVersion87]", @@ -15510,7 +15510,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spam Detections by Delivery Location - Medium_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spam Detections by Delivery Location - Medium_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject88').huntingQueryVersion88]", @@ -15596,7 +15596,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 100 malicious email senders_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 100 malicious email senders_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject89').huntingQueryVersion89]", @@ -15682,7 +15682,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 100 senders_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 100 senders_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject90').huntingQueryVersion90]", @@ -15768,7 +15768,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Zero day threats_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Zero day threats_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject91').huntingQueryVersion91]", @@ -15854,7 +15854,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Email containing malware accessed on a unmanaged device_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Email containing malware accessed on a unmanaged device_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject92').huntingQueryVersion92]", @@ -15940,7 +15940,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Email containing malware sent by an internal sender_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Email containing malware sent by an internal sender_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject93').huntingQueryVersion93]", @@ -16026,7 +16026,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Email malware detection report_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Email malware detection report_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject94').huntingQueryVersion94]", @@ -16112,7 +16112,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "File Malware Detection Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "File Malware Detection Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject95').huntingQueryVersion95]", @@ -16198,7 +16198,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "File Malware Top Families by AV_HuntingQueries Hunting Query with template version 3.2.1", + "description": "File Malware Top Families by AV_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject96').huntingQueryVersion96]", @@ -16284,7 +16284,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "File Malware Top Families by Safe Attachments_HuntingQueries Hunting Query with template version 3.2.1", + "description": "File Malware Top Families by Safe Attachments_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject97').huntingQueryVersion97]", @@ -16370,7 +16370,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malware Detection Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malware Detection Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject98').huntingQueryVersion98]", @@ -16456,7 +16456,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malware Detections by Delivery Location_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malware Detections by Delivery Location_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject99').huntingQueryVersion99]", @@ -16542,7 +16542,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malware Detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malware Detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject100').huntingQueryVersion100]", @@ -16628,7 +16628,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malware Detections by Detection Technology_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malware Detections by Detection Technology_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject101').huntingQueryVersion101]", @@ -16714,7 +16714,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malware detections by Workload Locations_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malware detections by Workload Locations_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject102').huntingQueryVersion102]", @@ -16800,7 +16800,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malware detections by Workload Type_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malware detections by Workload Type_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject103').huntingQueryVersion103]", @@ -16886,7 +16886,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Domains sending Malware_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Domains sending Malware_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject104').huntingQueryVersion104]", @@ -16972,7 +16972,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Email Malware Families_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Email Malware Families_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject105').huntingQueryVersion105]", @@ -17058,7 +17058,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Users receiving Malware_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Users receiving Malware_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject106').huntingQueryVersion106]", @@ -17144,7 +17144,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Zero-day Malware Detections Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Zero-day Malware Detections Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject107').huntingQueryVersion107]", @@ -17230,7 +17230,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Communication from suspicious external users_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Communication from suspicious external users_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject108').huntingQueryVersion108]", @@ -17316,7 +17316,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Communication to suspicious external users_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Communication to suspicious external users_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject109').huntingQueryVersion109]", @@ -17402,7 +17402,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Expanding recipients into separate rows_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Expanding recipients into separate rows_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject110').huntingQueryVersion110]", @@ -17488,7 +17488,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "External malicious Teams messages sent from internal senders_HuntingQueries Hunting Query with template version 3.2.1", + "description": "External malicious Teams messages sent from internal senders_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject111').huntingQueryVersion111]", @@ -17574,7 +17574,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Hunt for malicious messages using External Threat Intelligence_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Hunt for malicious messages using External Threat Intelligence_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject112').huntingQueryVersion112]", @@ -17660,7 +17660,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Inbound Teams messages by sender domains_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Inbound Teams messages by sender domains_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject113').huntingQueryVersion113]", @@ -17746,7 +17746,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malicious Teams messages by URL detection methods_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malicious Teams messages by URL detection methods_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject114').huntingQueryVersion114]", @@ -17832,7 +17832,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malicious Teams messages received from external senders_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malicious Teams messages received from external senders_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject115').huntingQueryVersion115]", @@ -17918,7 +17918,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Teams chat initiated by a suspicious external user_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Microsoft Teams chat initiated by a suspicious external user_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject116').huntingQueryVersion116]", @@ -18004,7 +18004,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Number of unique accounts performing Teams message Admin submissions_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Number of unique accounts performing Teams message Admin submissions_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject117').huntingQueryVersion117]", @@ -18090,7 +18090,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Number of unique accounts performing Teams message User submissions_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Number of unique accounts performing Teams message User submissions_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject118').huntingQueryVersion118]", @@ -18176,7 +18176,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Possible partner impersonation in external Team messages_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Possible partner impersonation in external Team messages_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject119').huntingQueryVersion119]", @@ -18262,7 +18262,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Possible Teams phishing activity_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Possible Teams phishing activity_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject120').huntingQueryVersion120]", @@ -18348,7 +18348,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Potentially malicious URL click in Teams_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Potentially malicious URL click in Teams_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject121').huntingQueryVersion121]", @@ -18434,7 +18434,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Rare Domains in External Teams Messages_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Rare Domains in External Teams Messages_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject122').huntingQueryVersion122]", @@ -18520,7 +18520,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Suspicious Teams Display Name_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Suspicious Teams Display Name_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject123').huntingQueryVersion123]", @@ -18606,7 +18606,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams Admin submission of Malware and Phish daily trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams Admin submission of Malware and Phish daily trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject124').huntingQueryVersion124]", @@ -18692,7 +18692,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams Admin submission of No Threats daily trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams Admin submission of No Threats daily trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject125').huntingQueryVersion125]", @@ -18778,7 +18778,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams Admin-User Submissions Grading Verdicts_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams Admin-User Submissions Grading Verdicts_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject126').huntingQueryVersion126]", @@ -18864,7 +18864,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams blocked URL clicks daily trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams blocked URL clicks daily trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject127').huntingQueryVersion127]", @@ -18950,7 +18950,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams Malware ZAP _HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams Malware ZAP _HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject128').huntingQueryVersion128]", @@ -19036,7 +19036,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams Message with URL listed on OpenPhish_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams Message with URL listed on OpenPhish_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject129').huntingQueryVersion129]", @@ -19122,7 +19122,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams message ZAPed with the same URL in Email_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams message ZAPed with the same URL in Email_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject130').huntingQueryVersion130]", @@ -19208,7 +19208,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams messages from a specific sender by ThreadType_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams messages from a specific sender by ThreadType_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject131').huntingQueryVersion131]", @@ -19294,7 +19294,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams messages with suspicious URL domains_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams messages with suspicious URL domains_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject132').huntingQueryVersion132]", @@ -19380,7 +19380,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams Phish ZAP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams Phish ZAP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject133').huntingQueryVersion133]", @@ -19466,7 +19466,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams post delivery events daily trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams post delivery events daily trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject134').huntingQueryVersion134]", @@ -19552,7 +19552,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams Spam ZAP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams Spam ZAP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject135').huntingQueryVersion135]", @@ -19638,7 +19638,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams URL clicks actions summarized by URLs clicked on_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams URL clicks actions summarized by URLs clicked on_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject136').huntingQueryVersion136]", @@ -19724,7 +19724,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams URL clicks through actions on Phish or Malware URLs summarized by URLs_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams URL clicks through actions on Phish or Malware URLs summarized by URLs_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject137').huntingQueryVersion137]", @@ -19810,7 +19810,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams User submissions daily trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams User submissions daily trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject138').huntingQueryVersion138]", @@ -19896,7 +19896,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams users clicking on suspicious URL domains_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams users clicking on suspicious URL domains_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject139').huntingQueryVersion139]", @@ -19982,7 +19982,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 Attacked user by Phish messages_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 Attacked user by Phish messages_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject140').huntingQueryVersion140]", @@ -20068,7 +20068,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 external senders sending Teams messages_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 external senders sending Teams messages_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject141').huntingQueryVersion141]", @@ -20154,7 +20154,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 External senders sending Teams phishing messsages_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 External senders sending Teams phishing messsages_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject142').huntingQueryVersion142]", @@ -20240,7 +20240,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 sender domains - Admin Teams message submissions FN_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 sender domains - Admin Teams message submissions FN_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject143').huntingQueryVersion143]", @@ -20326,7 +20326,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 sender domains - Teams user submissions FN or FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 sender domains - Teams user submissions FN or FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject144').huntingQueryVersion144]", @@ -20412,7 +20412,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 senders - Teams users submissions FN or FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 senders - Teams users submissions FN or FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject145').huntingQueryVersion145]", @@ -20498,7 +20498,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 senders of Admin Teams message submissions FN_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 senders of Admin Teams message submissions FN_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject146').huntingQueryVersion146]", @@ -20584,7 +20584,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 senders of Admin Teams message submissions FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 senders of Admin Teams message submissions FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject147').huntingQueryVersion147]", @@ -20670,7 +20670,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 Users clicking on malicious URLs in Teams_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 Users clicking on malicious URLs in Teams_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject148').huntingQueryVersion148]", @@ -20756,7 +20756,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top accounts performing Teams admin submissions FN or FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top accounts performing Teams admin submissions FN or FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject149').huntingQueryVersion149]", @@ -20842,7 +20842,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top accounts performing Teams user submissions FN or FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top accounts performing Teams user submissions FN or FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject150').huntingQueryVersion150]", @@ -20928,7 +20928,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top domains outbound sending Malicious Teams messages inbound_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top domains outbound sending Malicious Teams messages inbound_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject151').huntingQueryVersion151]", @@ -21014,7 +21014,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top external malicious senders_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top external malicious senders_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject152').huntingQueryVersion152]", @@ -21100,7 +21100,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top External Sender domains - Malware_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top External Sender domains - Malware_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject153').huntingQueryVersion153]", @@ -21186,7 +21186,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top External Sender domains - Phish_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top External Sender domains - Phish_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject154').huntingQueryVersion154]", @@ -21272,7 +21272,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top External Sender domains - Spam_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top External Sender domains - Spam_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject155').huntingQueryVersion155]", @@ -21358,7 +21358,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top malicious URLs clicked by users in Teams_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top malicious URLs clicked by users in Teams_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject156').huntingQueryVersion156]", @@ -21444,7 +21444,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Total number of MDO Teams protection detections daily_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Total number of MDO Teams protection detections daily_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject157').huntingQueryVersion157]", @@ -21530,7 +21530,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URL click on URLs in ZAP-d Teams messages_HuntingQueries Hunting Query with template version 3.2.1", + "description": "URL click on URLs in ZAP-d Teams messages_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject158').huntingQueryVersion158]", @@ -21616,7 +21616,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spam and Phish delivered to Inbox due to Admin Overrides_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spam and Phish delivered to Inbox due to Admin Overrides_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject159').huntingQueryVersion159]", @@ -21702,7 +21702,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spam and Phish delivered to Inbox due to User Overrides_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spam and Phish delivered to Inbox due to User Overrides_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject160').huntingQueryVersion160]", @@ -21788,7 +21788,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top policies performing admin overrides_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top policies performing admin overrides_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject161').huntingQueryVersion161]", @@ -21874,7 +21874,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top policies performing user overrides_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top policies performing user overrides_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject162').huntingQueryVersion162]", @@ -21960,7 +21960,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Total Emails with Admin Overrides - Allow_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Total Emails with Admin Overrides - Allow_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject163').huntingQueryVersion163]", @@ -22046,7 +22046,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Total Emails with Admin Overrides - Block_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Total Emails with Admin Overrides - Block_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject164').huntingQueryVersion164]", @@ -22132,7 +22132,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Total Emails with User Overrides - Allow_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Total Emails with User Overrides - Allow_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject165').huntingQueryVersion165]", @@ -22218,7 +22218,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Total Emails with User Overrides - Block_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Total Emails with User Overrides - Block_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject166').huntingQueryVersion166]", @@ -22304,7 +22304,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Phish Detection Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Phish Detection Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject167').huntingQueryVersion167]", @@ -22390,7 +22390,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Phish Detections by Delivery Location - High_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Phish Detections by Delivery Location - High_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject168').huntingQueryVersion168]", @@ -22476,7 +22476,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Phish Detections by Delivery Location - Medium_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Phish Detections by Delivery Location - Medium_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject169').huntingQueryVersion169]", @@ -22562,7 +22562,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Phish Detections by Delivery Location Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Phish Detections by Delivery Location Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject170').huntingQueryVersion170]", @@ -22648,7 +22648,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Phish Detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Phish Detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject171').huntingQueryVersion171]", @@ -22734,7 +22734,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Phish Detections by Detection Technology_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Phish Detections by Detection Technology_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject172').huntingQueryVersion172]", @@ -22820,7 +22820,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Possible device code phishing attempts_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Possible device code phishing attempts_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject173').huntingQueryVersion173]", @@ -22906,7 +22906,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Domains sending Phish_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Domains sending Phish_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject174').huntingQueryVersion174]", @@ -22992,7 +22992,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Users receiving Phish_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Users receiving Phish_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject175').huntingQueryVersion175]", @@ -23078,7 +23078,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Zero-day Phish Detections Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Zero-day Phish Detections Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject176').huntingQueryVersion176]", @@ -23164,7 +23164,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Campaign with randomly named attachments_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Campaign with randomly named attachments_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject177').huntingQueryVersion177]", @@ -23250,7 +23250,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Campaign with suspicious keywords_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Campaign with suspicious keywords_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject178').huntingQueryVersion178]", @@ -23336,7 +23336,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Custom detection-Emails with QR from non-prevalent senders_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Custom detection-Emails with QR from non-prevalent senders_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject179').huntingQueryVersion179]", @@ -23422,7 +23422,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Emails delivered having URLs from QR codes_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Emails delivered having URLs from QR codes_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject180').huntingQueryVersion180]", @@ -23508,7 +23508,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Emails with QR codes and suspicious keywords in subject_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Emails with QR codes and suspicious keywords in subject_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject181').huntingQueryVersion181]", @@ -23594,7 +23594,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Emails with QR codes from non-prevalent sender_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Emails with QR codes from non-prevalent sender_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject182').huntingQueryVersion182]", @@ -23680,7 +23680,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Hunting for sender patterns_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Hunting for sender patterns_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject183').huntingQueryVersion183]", @@ -23766,7 +23766,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Hunting for user signals-clusters_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Hunting for user signals-clusters_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject184').huntingQueryVersion184]", @@ -23852,7 +23852,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Inbound emails with QR code URLs_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Inbound emails with QR code URLs_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject185').huntingQueryVersion185]", @@ -23938,7 +23938,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Personalized campaigns based on the first few keywords_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Personalized campaigns based on the first few keywords_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject186').huntingQueryVersion186]", @@ -24024,7 +24024,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Personalized campaigns based on the last few keywords_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Personalized campaigns based on the last few keywords_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject187').huntingQueryVersion187]", @@ -24110,7 +24110,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Risky sign-in attempt from a non-managed device_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Risky sign-in attempt from a non-managed device_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject188').huntingQueryVersion188]", @@ -24196,7 +24196,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Suspicious sign-in attempts from QR code phishing campaigns_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Suspicious sign-in attempts from QR code phishing campaigns_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject189').huntingQueryVersion189]", @@ -24282,7 +24282,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Group quarantine release_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Group quarantine release_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject190').huntingQueryVersion190]", @@ -24368,7 +24368,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "High Confidence Phish Released_HuntingQueries Hunting Query with template version 3.2.1", + "description": "High Confidence Phish Released_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject191').huntingQueryVersion191]", @@ -24454,7 +24454,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Quarantine Phish reason trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Quarantine Phish reason trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject192').huntingQueryVersion192]", @@ -24540,7 +24540,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Quarantine Phish reason_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Quarantine Phish reason_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject193').huntingQueryVersion193]", @@ -24626,7 +24626,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Quarantine Release Email Details_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Quarantine Release Email Details_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject194').huntingQueryVersion194]", @@ -24712,7 +24712,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Quarantine release trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Quarantine release trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject195').huntingQueryVersion195]", @@ -24798,7 +24798,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Quarantine releases by Detection types_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Quarantine releases by Detection types_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject196').huntingQueryVersion196]", @@ -24884,7 +24884,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Quarantine Spam reason trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Quarantine Spam reason trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject197').huntingQueryVersion197]", @@ -24970,7 +24970,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Quarantine Spam reason_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Quarantine Spam reason_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject198').huntingQueryVersion198]", @@ -25056,7 +25056,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AIR investigation actions insight_HuntingQueries Hunting Query with template version 3.2.1", + "description": "AIR investigation actions insight_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject199').huntingQueryVersion199]", @@ -25142,7 +25142,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Email remediation action list_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Email remediation action list_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject200').huntingQueryVersion200]", @@ -25228,7 +25228,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Bulk Detection Top10 Domains_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Bulk Detection Top10 Domains_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject201').huntingQueryVersion201]", @@ -25314,7 +25314,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spam Detection Delivery Location_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spam Detection Delivery Location_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject202').huntingQueryVersion202]", @@ -25400,7 +25400,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spam Detection IP and Geo Position_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spam Detection IP and Geo Position_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject203').huntingQueryVersion203]", @@ -25486,7 +25486,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spam Detection Mails with BCL_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spam Detection Mails with BCL_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject204').huntingQueryVersion204]", @@ -25572,7 +25572,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spam Detection Tech_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spam Detection Tech_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject205').huntingQueryVersion205]", @@ -25658,7 +25658,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spam Detection Top10 Domains_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spam Detection Top10 Domains_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject206').huntingQueryVersion206]", @@ -25744,7 +25744,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spam Detection Top10 Users_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spam Detection Top10 Users_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject207').huntingQueryVersion207]", @@ -25830,7 +25830,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spam Detection Top15 Domains Details_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spam Detection Top15 Domains Details_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject208').huntingQueryVersion208]", @@ -25916,7 +25916,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spam Detection Top15 Users Details_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spam Detection Top15 Users Details_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject209').huntingQueryVersion209]", @@ -26002,7 +26002,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spam Detection Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spam Detection Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject210').huntingQueryVersion210]", @@ -26088,7 +26088,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spam Detections by Detection technology_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spam Detections by Detection technology_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject211').huntingQueryVersion211]", @@ -26174,7 +26174,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Display Name - Spoof and Impersonation_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Display Name - Spoof and Impersonation_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject212').huntingQueryVersion212]", @@ -26260,7 +26260,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Impersonation Phishing detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Impersonation Phishing detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject213').huntingQueryVersion213]", @@ -26346,7 +26346,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Impersonation Phishing detections by Detection Technology_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Impersonation Phishing detections by Detection Technology_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject214').huntingQueryVersion214]", @@ -26432,7 +26432,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Impersonation Phishing detections trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Impersonation Phishing detections trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject215').huntingQueryVersion215]", @@ -26518,7 +26518,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Referral phish emails_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Referral phish emails_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject216').huntingQueryVersion216]", @@ -26604,7 +26604,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spoof and impersonation detections by sender IP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spoof and impersonation detections by sender IP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject217').huntingQueryVersion217]", @@ -26690,7 +26690,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spoof and impersonation phish detections_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spoof and impersonation phish detections_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject218').huntingQueryVersion218]", @@ -26776,7 +26776,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spoof detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spoof detections by Detection Technology Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject219').huntingQueryVersion219]", @@ -26862,7 +26862,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spoof detections by Detection Technology_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spoof detections by Detection Technology_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject220').huntingQueryVersion220]", @@ -26948,7 +26948,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spoof detections trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spoof detections trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject221').huntingQueryVersion221]", @@ -27034,7 +27034,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Domains with BEC Threats inbound_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Domains with BEC Threats inbound_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject222').huntingQueryVersion222]", @@ -27120,7 +27120,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User not covered under display name impersonation_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User not covered under display name impersonation_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject223').huntingQueryVersion223]", @@ -27206,7 +27206,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Admin Submission Trend - FN_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Admin Submission Trend - FN_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject224').huntingQueryVersion224]", @@ -27292,7 +27292,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Admin Submission Trend - FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Admin Submission Trend - FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject225').huntingQueryVersion225]", @@ -27378,7 +27378,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Admin Submissions by Detection Method - Phish FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Admin Submissions by Detection Method - Phish FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject226').huntingQueryVersion226]", @@ -27464,7 +27464,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Admin Submissions by Detection Method - Spam FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Admin Submissions by Detection Method - Spam FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject227').huntingQueryVersion227]", @@ -27550,7 +27550,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Admin Submissions by Detection Type_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Admin Submissions by Detection Type_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject228').huntingQueryVersion228]", @@ -27636,7 +27636,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Admin Submissions by Grading Verdict - FN-FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Admin Submissions by Grading Verdict - FN-FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject229').huntingQueryVersion229]", @@ -27722,7 +27722,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Admin Submissions by Submission State - FN_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Admin Submissions by Submission State - FN_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject230').huntingQueryVersion230]", @@ -27808,7 +27808,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Admin Submissions by Submission State - FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Admin Submissions by Submission State - FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject231').huntingQueryVersion231]", @@ -27894,7 +27894,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Admin Submissions by Submission Type - FN_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Admin Submissions by Submission Type - FN_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject232').huntingQueryVersion232]", @@ -27980,7 +27980,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Admin Submissions by Submission Type - FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Admin Submissions by Submission Type - FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject233').huntingQueryVersion233]", @@ -28066,7 +28066,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top accounts performing admin submissions - FN_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top accounts performing admin submissions - FN_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject234').huntingQueryVersion234]", @@ -28152,7 +28152,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top accounts performing admin submissions - FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top accounts performing admin submissions - FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject235').huntingQueryVersion235]", @@ -28238,7 +28238,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top accounts performing user submissions_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top accounts performing user submissions_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject236').huntingQueryVersion236]", @@ -28324,7 +28324,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Detection Overrides - Admin Submissions_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Detection Overrides - Admin Submissions_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject237').huntingQueryVersion237]", @@ -28410,7 +28410,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Sender Domains - Admin Submissions FN_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Sender Domains - Admin Submissions FN_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject238').huntingQueryVersion238]", @@ -28496,7 +28496,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Sender Domains - Admin Submissions FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Sender Domains - Admin Submissions FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject239').huntingQueryVersion239]", @@ -28582,7 +28582,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Total Submissions by Submission Status_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Total Submissions by Submission Status_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject240').huntingQueryVersion240]", @@ -28668,7 +28668,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Total Submissions by Submission Type_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Total Submissions by Submission Type_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject241').huntingQueryVersion241]", @@ -28754,7 +28754,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User reported submissions_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User reported submissions_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject242').huntingQueryVersion242]", @@ -28840,7 +28840,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submission Accuracy versus Admin Verdicts_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submission Accuracy versus Admin Verdicts_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject243').huntingQueryVersion243]", @@ -28926,7 +28926,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions - Top detection overrides by Admins_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions - Top detection overrides by Admins_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject244').huntingQueryVersion244]", @@ -29012,7 +29012,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions - Top detection overrides by Users_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions - Top detection overrides by Users_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject245').huntingQueryVersion245]", @@ -29098,7 +29098,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions - Top email (P2) senders domains_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions - Top email (P2) senders domains_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject246').huntingQueryVersion246]", @@ -29184,7 +29184,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions - Top email (P2) senders_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions - Top email (P2) senders_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject247').huntingQueryVersion247]", @@ -29270,7 +29270,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions - Top Intra-Org P2 senders_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions - Top Intra-Org P2 senders_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject248').huntingQueryVersion248]", @@ -29356,7 +29356,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions - Top Intra-Org Subjects_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions - Top Intra-Org Subjects_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject249').huntingQueryVersion249]", @@ -29442,7 +29442,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions by Admin review status_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions by Admin review status_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject250').huntingQueryVersion250]", @@ -29528,7 +29528,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions by Grading Verdict - FN-FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions by Grading Verdict - FN-FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject251').huntingQueryVersion251]", @@ -29614,7 +29614,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions by Submission Type_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions by Submission Type_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject252').huntingQueryVersion252]", @@ -29700,7 +29700,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions from Junk Folder_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions from Junk Folder_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject253').huntingQueryVersion253]", @@ -29786,7 +29786,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions Trend - FN_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions Trend - FN_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject254').huntingQueryVersion254]", @@ -29872,7 +29872,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Attacked more than x times average_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Attacked more than x times average_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject255').huntingQueryVersion255]", @@ -29958,7 +29958,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malicious mails by sender IPs_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malicious mails by sender IPs_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject256').huntingQueryVersion256]", @@ -30044,7 +30044,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 percent of most attacked users_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 percent of most attacked users_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject257').huntingQueryVersion257]", @@ -30130,7 +30130,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 URL domains attacking organization_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 URL domains attacking organization_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject258').huntingQueryVersion258]", @@ -30216,7 +30216,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top external malicious senders_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top external malicious senders_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject259').huntingQueryVersion259]", @@ -30302,7 +30302,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top targeted users_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top targeted users_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject260').huntingQueryVersion260]", @@ -30388,7 +30388,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "End user malicious clicks_HuntingQueries Hunting Query with template version 3.2.1", + "description": "End user malicious clicks_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject261').huntingQueryVersion261]", @@ -30474,7 +30474,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URL click count by click action_HuntingQueries Hunting Query with template version 3.2.1", + "description": "URL click count by click action_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject262').huntingQueryVersion262]", @@ -30560,7 +30560,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URL click on ZAP Email_HuntingQueries Hunting Query with template version 3.2.1", + "description": "URL click on ZAP Email_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject263').huntingQueryVersion263]", @@ -30646,7 +30646,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URL clicks actions by URL_HuntingQueries Hunting Query with template version 3.2.1", + "description": "URL clicks actions by URL_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject264').huntingQueryVersion264]", @@ -30732,7 +30732,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLClick details based on malicious URL click alert_HuntingQueries Hunting Query with template version 3.2.1", + "description": "URLClick details based on malicious URL click alert_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject265').huntingQueryVersion265]", @@ -30818,7 +30818,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User clicked through events_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User clicked through events_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject266').huntingQueryVersion266]", @@ -30904,7 +30904,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User clicks on malicious inbound emails_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User clicks on malicious inbound emails_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject267').huntingQueryVersion267]", @@ -30990,7 +30990,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User clicks on phishing URLs in emails_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User clicks on phishing URLs in emails_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject268').huntingQueryVersion268]", @@ -31076,7 +31076,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malicious Clicks allowed (click-through)_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malicious Clicks allowed (click-through)_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject269').huntingQueryVersion269]", @@ -31162,7 +31162,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malicious Emails with QR code Urls_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malicious Emails with QR code Urls_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject270').huntingQueryVersion270]", @@ -31248,7 +31248,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Phishing Email Url Redirector_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Phishing Email Url Redirector_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject271').huntingQueryVersion271]", @@ -31334,7 +31334,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SafeLinks URL detections_HuntingQueries Hunting Query with template version 3.2.1", + "description": "SafeLinks URL detections_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject272').huntingQueryVersion272]", @@ -31420,7 +31420,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 Users clicking on Malicious URLs (Malware)_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 Users clicking on Malicious URLs (Malware)_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject273').huntingQueryVersion273]", @@ -31506,7 +31506,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 Users clicking on Malicious URLs (Phish)_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 Users clicking on Malicious URLs (Phish)_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject274').huntingQueryVersion274]", @@ -31592,7 +31592,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 10 Users clicking on Malicious URLs (Spam)_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 10 Users clicking on Malicious URLs (Spam)_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject275').huntingQueryVersion275]", @@ -31678,7 +31678,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URL Click attempts by threat type_HuntingQueries Hunting Query with template version 3.2.1", + "description": "URL Click attempts by threat type_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject276').huntingQueryVersion276]", @@ -31764,7 +31764,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URL Clicks by Action_HuntingQueries Hunting Query with template version 3.2.1", + "description": "URL Clicks by Action_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject277').huntingQueryVersion277]", @@ -31850,7 +31850,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLs by location_HuntingQueries Hunting Query with template version 3.2.1", + "description": "URLs by location_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject278').huntingQueryVersion278]", @@ -31936,7 +31936,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Post Delivery Events by Admin_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Post Delivery Events by Admin_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject279').huntingQueryVersion279]", @@ -32022,7 +32022,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Post Delivery Events by Location_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Post Delivery Events by Location_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject280').huntingQueryVersion280]", @@ -32108,7 +32108,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Post Delivery Events by ZAP type_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Post Delivery Events by ZAP type_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject281').huntingQueryVersion281]", @@ -32194,7 +32194,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Post Delivery Events over time_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Post Delivery Events over time_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject282').huntingQueryVersion282]", @@ -32280,7 +32280,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailDelivered-ToInbox_HuntingQueries Hunting Query with template version 3.2.1", + "description": "EmailDelivered-ToInbox_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject283').huntingQueryVersion283]", @@ -32366,7 +32366,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AnomalousPayloadDeliveredWithISOFile_HuntingQueries Hunting Query with template version 3.2.1", + "description": "AnomalousPayloadDeliveredWithISOFile_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject284').huntingQueryVersion284]", @@ -32452,7 +32452,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "BitsadminActivity_HuntingQueries Hunting Query with template version 3.2.1", + "description": "BitsadminActivity_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject285').huntingQueryVersion285]", @@ -32534,7 +32534,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MaliciousUseOfMSIExec_HuntingQueries Hunting Query with template version 3.2.1", + "description": "MaliciousUseOfMSIExec_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject286').huntingQueryVersion286]", @@ -32616,7 +32616,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MaliciousUseOfMsiExecMimikatz_HuntingQueries Hunting Query with template version 3.2.1", + "description": "MaliciousUseOfMsiExecMimikatz_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject287').huntingQueryVersion287]", @@ -32698,7 +32698,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "OfficeAppsLaunchingWscript_HuntingQueries Hunting Query with template version 3.2.1", + "description": "OfficeAppsLaunchingWscript_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject288').huntingQueryVersion288]", @@ -32780,7 +32780,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PotentialKerberoastActivities_HuntingQueries Hunting Query with template version 3.2.1", + "description": "PotentialKerberoastActivities_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject289').huntingQueryVersion289]", @@ -32866,7 +32866,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PowerShellDownloads_HuntingQueries Hunting Query with template version 3.2.1", + "description": "PowerShellDownloads_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject290').huntingQueryVersion290]", @@ -32948,7 +32948,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousAppExeutedByWebserver_HuntingQueries Hunting Query with template version 3.2.1", + "description": "SuspiciousAppExeutedByWebserver_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject291').huntingQueryVersion291]", @@ -33030,7 +33030,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousMshtaUsage_HuntingQueries Hunting Query with template version 3.2.1", + "description": "SuspiciousMshtaUsage_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject292').huntingQueryVersion292]", @@ -33112,7 +33112,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FilesCopiedToUSBDrives_HuntingQueries Hunting Query with template version 3.2.1", + "description": "FilesCopiedToUSBDrives_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject293').huntingQueryVersion293]", @@ -33194,7 +33194,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CVE-2022-26134-Confluence_HuntingQueries Hunting Query with template version 3.2.1", + "description": "CVE-2022-26134-Confluence_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject294').huntingQueryVersion294]", @@ -33280,7 +33280,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MosaicLoader_HuntingQueries Hunting Query with template version 3.2.1", + "description": "MosaicLoader_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject295').huntingQueryVersion295]", @@ -33362,7 +33362,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SpoolsvSpawningRundll32_HuntingQueries Hunting Query with template version 3.2.1", + "description": "SpoolsvSpawningRundll32_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject296').huntingQueryVersion296]", @@ -33444,7 +33444,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousDLLInSpoolFolder_HuntingQueries Hunting Query with template version 3.2.1", + "description": "SuspiciousDLLInSpoolFolder_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject297').huntingQueryVersion297]", @@ -33526,7 +33526,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousFilesInSpoolFolder_HuntingQueries Hunting Query with template version 3.2.1", + "description": "SuspiciousFilesInSpoolFolder_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject298').huntingQueryVersion298]", @@ -33608,7 +33608,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousSpoolsvChildProcess_HuntingQueries Hunting Query with template version 3.2.1", + "description": "SuspiciousSpoolsvChildProcess_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject299').huntingQueryVersion299]", @@ -33690,7 +33690,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PrintNightmareUsageDetection-CVE-2021-1675_HuntingQueries Hunting Query with template version 3.2.1", + "description": "PrintNightmareUsageDetection-CVE-2021-1675_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject300').huntingQueryVersion300]", @@ -33772,7 +33772,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SuspiciousFileCreationByPrintSpoolerService_HuntingQueries Hunting Query with template version 3.2.1", + "description": "SuspiciousFileCreationByPrintSpoolerService_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject301').huntingQueryVersion301]", @@ -33858,7 +33858,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MITRESuspiciousEvents_HuntingQueries Hunting Query with template version 3.2.1", + "description": "MITRESuspiciousEvents_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject302').huntingQueryVersion302]", @@ -33936,7 +33936,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AnomalousVoulmeOfFileDeletion_HuntingQueries Hunting Query with template version 3.2.1", + "description": "AnomalousVoulmeOfFileDeletion_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject303').huntingQueryVersion303]", @@ -34018,7 +34018,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DetectMailSniper_HuntingQueries Hunting Query with template version 3.2.1", + "description": "DetectMailSniper_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject304').huntingQueryVersion304]", @@ -34100,7 +34100,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AccountBruteForce_HuntingQueries Hunting Query with template version 3.2.1", + "description": "AccountBruteForce_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject305').huntingQueryVersion305]", @@ -34178,7 +34178,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "RemoteFileCreationWithPsExec_HuntingQueries Hunting Query with template version 3.2.1", + "description": "RemoteFileCreationWithPsExec_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject306').huntingQueryVersion306]", @@ -34260,7 +34260,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ServiceAccountsPerformingRemotePS_HuntingQueries Hunting Query with template version 3.2.1", + "description": "ServiceAccountsPerformingRemotePS_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject307').huntingQueryVersion307]", @@ -34342,7 +34342,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AccountCreation_HuntingQueries Hunting Query with template version 3.2.1", + "description": "AccountCreation_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject308').huntingQueryVersion308]", @@ -34420,7 +34420,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "LocalAdminGroupChanges_HuntingQueries Hunting Query with template version 3.2.1", + "description": "LocalAdminGroupChanges_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject309').huntingQueryVersion309]", @@ -34502,7 +34502,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "RareProcessAsService_HuntingQueries Hunting Query with template version 3.2.1", + "description": "RareProcessAsService_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject310').huntingQueryVersion310]", @@ -34588,7 +34588,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ScheduledTaskCreation_HuntingQueries Hunting Query with template version 3.2.1", + "description": "ScheduledTaskCreation_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject311').huntingQueryVersion311]", @@ -34670,7 +34670,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SAMNameChange_CVE-2021-42278_HuntingQueries Hunting Query with template version 3.2.1", + "description": "SAMNameChange_CVE-2021-42278_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject312').huntingQueryVersion312]", @@ -34752,7 +34752,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DataDeletionOnMulipleDrivesUsingCipherExe_HuntingQueries Hunting Query with template version 3.2.1", + "description": "DataDeletionOnMulipleDrivesUsingCipherExe_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject313').huntingQueryVersion313]", @@ -34834,7 +34834,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DetectMultipleSignsOfRamsomwareActivity_HuntingQueries Hunting Query with template version 3.2.1", + "description": "DetectMultipleSignsOfRamsomwareActivity_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject314').huntingQueryVersion314]", @@ -34916,7 +34916,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DisableSecurityServiceViaRegistry_HuntingQueries Hunting Query with template version 3.2.1", + "description": "DisableSecurityServiceViaRegistry_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject315').huntingQueryVersion315]", @@ -34998,7 +34998,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainDiscoveryWMICwithDLLHostExe_HuntingQueries Hunting Query with template version 3.2.1", + "description": "DomainDiscoveryWMICwithDLLHostExe_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject316').huntingQueryVersion316]", @@ -35080,7 +35080,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MDEExclusionUsingPowerShell_HuntingQueries Hunting Query with template version 3.2.1", + "description": "MDEExclusionUsingPowerShell_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject317').huntingQueryVersion317]", @@ -35162,7 +35162,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IcedIdSuspiciousImageLoad_HuntingQueries Hunting Query with template version 3.2.1", + "description": "IcedIdSuspiciousImageLoad_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject318').huntingQueryVersion318]", @@ -35244,7 +35244,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "LaZagneCredTheft_HuntingQueries Hunting Query with template version 3.2.1", + "description": "LaZagneCredTheft_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject319').huntingQueryVersion319]", @@ -35326,7 +35326,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "LogDeletionUsingWevtutil_HuntingQueries Hunting Query with template version 3.2.1", + "description": "LogDeletionUsingWevtutil_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject320').huntingQueryVersion320]", @@ -35408,7 +35408,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MultiProcessKillWithTaskKill_HuntingQueries Hunting Query with template version 3.2.1", + "description": "MultiProcessKillWithTaskKill_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject321').huntingQueryVersion321]", @@ -35490,7 +35490,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PotentialCobaltStrikeRansomwareActivity_HuntingQueries Hunting Query with template version 3.2.1", + "description": "PotentialCobaltStrikeRansomwareActivity_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject322').huntingQueryVersion322]", @@ -35572,7 +35572,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "QakbotDiscoveryActivities_HuntingQueries Hunting Query with template version 3.2.1", + "description": "QakbotDiscoveryActivities_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject323').huntingQueryVersion323]", @@ -35654,7 +35654,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ShadowCopyDeletion_HuntingQueries Hunting Query with template version 3.2.1", + "description": "ShadowCopyDeletion_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject324').huntingQueryVersion324]", @@ -35740,7 +35740,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "TurningOffServicesWithSCCommad_HuntingQueries Hunting Query with template version 3.2.1", + "description": "TurningOffServicesWithSCCommad_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject325').huntingQueryVersion325]", @@ -35822,7 +35822,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Detect_CISA_Alert_AA22-117A2021_Top_Routinely_Exploited_Vulnerabilities_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Detect_CISA_Alert_AA22-117A2021_Top_Routinely_Exploited_Vulnerabilities_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject326').huntingQueryVersion326]", @@ -35904,7 +35904,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Punycode chars lookalike domains_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Punycode chars lookalike domains_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject327').huntingQueryVersion327]", @@ -35990,7 +35990,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Hunt for RMM tool execution following Teams messages_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Hunt for RMM tool execution following Teams messages_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject328').huntingQueryVersion328]", @@ -36076,7 +36076,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Hunt for alerts correlated with Teams messages_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Hunt for alerts correlated with Teams messages_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject329').huntingQueryVersion329]", @@ -36162,7 +36162,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Identify acting user for reported phish_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Identify acting user for reported phish_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject330').huntingQueryVersion330]", @@ -36248,7 +36248,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Inbound Sender Domains Failing Email Authentication_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Inbound Sender Domains Failing Email Authentication_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject331').huntingQueryVersion331]", @@ -36334,7 +36334,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Automatic External Email Forwarding by Type_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Automatic External Email Forwarding by Type_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject332').huntingQueryVersion332]", @@ -36420,7 +36420,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "First-Contact External Email Senders_HuntingQueries Hunting Query with template version 3.2.1", + "description": "First-Contact External Email Senders_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject333').huntingQueryVersion333]", @@ -36506,7 +36506,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "New External Sender Domains Carrying Threats_HuntingQueries Hunting Query with template version 3.2.1", + "description": "New External Sender Domains Carrying Threats_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject334').huntingQueryVersion334]", @@ -36592,7 +36592,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top External Domains Receiving Auto-forwarded Email_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top External Domains Receiving Auto-forwarded Email_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject335').huntingQueryVersion335]", @@ -36678,7 +36678,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top External Recipients Receiving Auto-forwarded Email_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top External Recipients Receiving Auto-forwarded Email_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject336').huntingQueryVersion336]", @@ -36764,7 +36764,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Users Auto-forwarding Email Externally_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Users Auto-forwarding Email Externally_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject337').huntingQueryVersion337]", @@ -36850,7 +36850,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "File Malware Detections Over Time_HuntingQueries Hunting Query with template version 3.2.1", + "description": "File Malware Detections Over Time_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject338').huntingQueryVersion338]", @@ -36936,7 +36936,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "File Malware Detections by Location_HuntingQueries Hunting Query with template version 3.2.1", + "description": "File Malware Detections by Location_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject339').huntingQueryVersion339]", @@ -37022,7 +37022,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "File Malware Detections by Workload_HuntingQueries Hunting Query with template version 3.2.1", + "description": "File Malware Detections by Workload_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject340').huntingQueryVersion340]", @@ -37108,7 +37108,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "File Malware Top Families by MDO Detonation_HuntingQueries Hunting Query with template version 3.2.1", + "description": "File Malware Top Families by MDO Detonation_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject341').huntingQueryVersion341]", @@ -37194,7 +37194,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "File Malware Top Families by SharePoint Antivirus_HuntingQueries Hunting Query with template version 3.2.1", + "description": "File Malware Top Families by SharePoint Antivirus_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject342').huntingQueryVersion342]", @@ -37280,7 +37280,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "File Scanning Coverage_HuntingQueries Hunting Query with template version 3.2.1", + "description": "File Scanning Coverage_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject343').huntingQueryVersion343]", @@ -37366,7 +37366,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malware Detection IP and Geo Position_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malware Detection IP and Geo Position_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject344').huntingQueryVersion344]", @@ -37452,7 +37452,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malware Detections by Sender Country_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malware Detections by Sender Country_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject345').huntingQueryVersion345]", @@ -37538,7 +37538,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malware Detections by Threat Classification_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malware Detections by Threat Classification_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject346').huntingQueryVersion346]", @@ -37624,7 +37624,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Attacked Users by Malware Threat Classification_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Attacked Users by Malware Threat Classification_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject347').huntingQueryVersion347]", @@ -37710,7 +37710,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top File Owners Holding Malware_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top File Owners Holding Malware_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject348').huntingQueryVersion348]", @@ -37796,7 +37796,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "First-Contact External Teams Senders_HuntingQueries Hunting Query with template version 3.2.1", + "description": "First-Contact External Teams Senders_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject349').huntingQueryVersion349]", @@ -37882,7 +37882,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malicious files shared in Microsoft Teams_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malicious files shared in Microsoft Teams_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject350').huntingQueryVersion350]", @@ -37968,7 +37968,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Teams External versus Internal Thread Exposure_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Microsoft Teams External versus Internal Thread Exposure_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject351').huntingQueryVersion351]", @@ -38054,7 +38054,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Teams File Protection Summary_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Teams File Protection Summary_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject352').huntingQueryVersion352]", @@ -38140,7 +38140,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SecOps Mailbox Override Count_HuntingQueries Hunting Query with template version 3.2.1", + "description": "SecOps Mailbox Override Count_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject353').huntingQueryVersion353]", @@ -38226,7 +38226,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SecOps Mailbox Overrides by Threat Type_HuntingQueries Hunting Query with template version 3.2.1", + "description": "SecOps Mailbox Overrides by Threat Type_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject354').huntingQueryVersion354]", @@ -38312,7 +38312,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Recipients Receiving Threats Delivered by Override_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Recipients Receiving Threats Delivered by Override_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject355').huntingQueryVersion355]", @@ -38398,7 +38398,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Sender Domains Delivering Threats via Override_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Sender Domains Delivering Threats via Override_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject356').huntingQueryVersion356]", @@ -38484,7 +38484,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Phish Detection IP and Geo Position_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Phish Detection IP and Geo Position_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject357').huntingQueryVersion357]", @@ -38570,7 +38570,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Phish Detections by Sender Country_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Phish Detections by Sender Country_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject358').huntingQueryVersion358]", @@ -38656,7 +38656,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Phish Detections by Threat Classification_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Phish Detections by Threat Classification_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject359').huntingQueryVersion359]", @@ -38742,7 +38742,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Phishing Detected by LLM Content Analysis_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Phishing Detected by LLM Content Analysis_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject360').huntingQueryVersion360]", @@ -38828,7 +38828,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Attacked Users by Phish Threat Classification_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Attacked Users by Phish Threat Classification_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject361').huntingQueryVersion361]", @@ -38914,7 +38914,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Quarantine Release Percentage_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Quarantine Release Percentage_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject362').huntingQueryVersion362]", @@ -39000,7 +39000,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Automated Investigation Outcomes by Day_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Automated Investigation Outcomes by Day_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject363').huntingQueryVersion363]", @@ -39086,7 +39086,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Automated Remediation Delivery to Action Latency_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Automated Remediation Delivery to Action Latency_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject364').huntingQueryVersion364]", @@ -39172,7 +39172,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Automated Remediation Efficiency Over Time_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Automated Remediation Efficiency Over Time_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject365').huntingQueryVersion365]", @@ -39258,7 +39258,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Automated Remediation Manual versus Automatic Approval_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Automated Remediation Manual versus Automatic Approval_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject366').huntingQueryVersion366]", @@ -39344,7 +39344,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Spam Detections by Sender Country_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Spam Detections by Sender Country_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject367').huntingQueryVersion367]", @@ -39430,7 +39430,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Impersonation and Spoof Detections by Sender Country_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Impersonation and Spoof Detections by Sender Country_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject368').huntingQueryVersion368]", @@ -39516,7 +39516,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Recipients Targeted by Impersonation or BEC_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Recipients Targeted by Impersonation or BEC_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject369').huntingQueryVersion369]", @@ -39602,7 +39602,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top accounts performing user submissions - FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top accounts performing user submissions - FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject370').huntingQueryVersion370]", @@ -39688,7 +39688,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions - Top Inbound Subjects FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions - Top Inbound Subjects FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject371').huntingQueryVersion371]", @@ -39774,7 +39774,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions - Top Intra-Org P2 senders FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions - Top Intra-Org P2 senders FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject372').huntingQueryVersion372]", @@ -39860,7 +39860,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions - Top email (P2) sender domains FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions - Top email (P2) sender domains FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject373').huntingQueryVersion373]", @@ -39946,7 +39946,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions - Top email (P2) senders FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions - Top email (P2) senders FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject374').huntingQueryVersion374]", @@ -40032,7 +40032,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions Trend - FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions Trend - FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject375').huntingQueryVersion375]", @@ -40118,7 +40118,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions by Detection Method - Phish FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions by Detection Method - Phish FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject376').huntingQueryVersion376]", @@ -40204,7 +40204,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions by Detection Method - Spam FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions by Detection Method - Spam FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject377').huntingQueryVersion377]", @@ -40290,7 +40290,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "User Submissions by Submission State - FP_HuntingQueries Hunting Query with template version 3.2.1", + "description": "User Submissions by Submission State - FP_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject378').huntingQueryVersion378]", @@ -40376,7 +40376,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Largest Malicious Email Campaigns by Cluster_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Largest Malicious Email Campaigns by Cluster_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject379').huntingQueryVersion379]", @@ -40462,7 +40462,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Blocked URL Clicks by Workload_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Blocked URL Clicks by Workload_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject380').huntingQueryVersion380]", @@ -40548,7 +40548,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top 20 Malicious URLs by Clicks_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top 20 Malicious URLs by Clicks_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject381').huntingQueryVersion381]", @@ -40634,7 +40634,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Top Clicks on Malicious URLs_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Top Clicks on Malicious URLs_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject382').huntingQueryVersion382]", @@ -40720,7 +40720,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URL Click-Through by Workload_HuntingQueries Hunting Query with template version 3.2.1", + "description": "URL Click-Through by Workload_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject383').huntingQueryVersion383]", @@ -40806,7 +40806,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URL Threat Protection Summary_HuntingQueries Hunting Query with template version 3.2.1", + "description": "URL Threat Protection Summary_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject384').huntingQueryVersion384]", @@ -40892,7 +40892,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Malware URL Detections Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Malware URL Detections Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject385').huntingQueryVersion385]", @@ -40978,7 +40978,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Phishing URL Detections Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "Phishing URL Detections Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject386').huntingQueryVersion386]", @@ -41064,7 +41064,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "QR Code URL Detections Trend_HuntingQueries Hunting Query with template version 3.2.1", + "description": "QR Code URL Detections Trend_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject387').huntingQueryVersion387]", @@ -41150,7 +41150,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MicrosoftDefenderForOffice365detectionsandinsights Workbook with template version 3.2.1", + "description": "MicrosoftDefenderForOffice365detectionsandinsights Workbook with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -41275,7 +41275,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MicrosoftDefenderForEndPoint Workbook with template version 3.2.1", + "description": "MicrosoftDefenderForEndPoint Workbook with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -41351,7 +41351,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MicrosoftDefenderForIdentity Workbook with template version 3.2.1", + "description": "MicrosoftDefenderForIdentity Workbook with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion3')]", @@ -41444,7 +41444,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.2.1", + "version": "3.2.2", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Microsoft Defender XDR", @@ -43632,17 +43632,17 @@ { "kind": "DefenderWorkbook", "contentId": "05a7425a-fcda-5e24-823d-f8c9dd7a6215", - "version": "3.2.1" + "version": "3.2.2" }, { "kind": "DefenderWorkbook", "contentId": "200c5dd2-9786-5619-8425-4508a238d76a", - "version": "3.2.1" + "version": "3.2.2" }, { "kind": "DefenderWorkbook", "contentId": "e39952df-ba60-50cf-80f6-76f7a2ebf57c", - "version": "3.2.1" + "version": "3.2.2" } ] }, @@ -43686,7 +43686,7 @@ "type": "Microsoft.Security/workbooks@2026-06-01-preview", "properties": { "id": "4fffade5-9b6b-51af-a33d-97641e240595", - "name": "MicrosoftDefenderForEndPoint", + "name": "Microsoft Defender For EndPoint", "content": { "version": "Notebook/1.0", "items": [ @@ -43883,14 +43883,20 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let AllDeviceNames = DeviceInfo | distinct DeviceId, DeviceName;\nlet DeviceEventSummary = DeviceEvents | extend Type = \"DeviceEvents\" | summarize count() by DeviceId, Type, bin(TimeGenerated,1d);\nlet DeviceNetworkEventsSummary = DeviceNetworkEvents | extend Type = \"DeviceNetworkEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceNetworkInfoSummary = DeviceNetworkInfo | extend Type = \"DeviceNetworkInfo\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceLogonEventsSummary = DeviceLogonEvents | extend Type = \"DeviceLogonEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceRegistryEventsSummary = DeviceRegistryEvents | extend Type = \"DeviceRegistryEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceProcessEventsSummary = DeviceProcessEvents | extend Type = \"DeviceProcessEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\n(DeviceEventSummary\n| union DeviceNetworkEventsSummary,\nDeviceNetworkEventsSummary,\nDeviceNetworkInfoSummary,\nDeviceLogonEventsSummary,\nDeviceRegistryEventsSummary,\nDeviceProcessEventsSummary)\n| join kind=inner ( \nAllDeviceNames\n)\non $left.DeviceId == $right.DeviceId\n| project-reorder Type, TimeGenerated, count_\n//| project-away DeviceId, DeviceId1", + "query": "let AllDeviceNames = DeviceInfo | distinct DeviceId, DeviceName;\nlet DeviceEventSummary = DeviceEvents | extend Type = \"DeviceEvents\" | summarize count() by DeviceId, Type, bin(TimeGenerated,1d);\nlet DeviceNetworkEventsSummary = DeviceNetworkEvents | extend Type = \"DeviceNetworkEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceNetworkInfoSummary = DeviceNetworkInfo | extend Type = \"DeviceNetworkInfo\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceLogonEventsSummary = DeviceLogonEvents | extend Type = \"DeviceLogonEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceRegistryEventsSummary = DeviceRegistryEvents | extend Type = \"DeviceRegistryEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceProcessEventsSummary = DeviceProcessEvents | extend Type = \"DeviceProcessEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\n(DeviceEventSummary\n| union DeviceNetworkEventsSummary,\nDeviceNetworkInfoSummary,\nDeviceLogonEventsSummary,\nDeviceRegistryEventsSummary,\nDeviceProcessEventsSummary)\n| join kind=inner ( \nAllDeviceNames\n)\non $left.DeviceId == $right.DeviceId\n| project-reorder Type, TimeGenerated, count_\n//| project-away DeviceId, DeviceId1", "size": 1, "title": "Daily Data Flow on MDE Tables over {TimeRange}", "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "timechart", "chartSettings": { - "xAxis": "count_" + "xAxis": "TimeGenerated", + "yAxis": [ + "count_" + ], + "splitBy": [ + "Type" + ] } }, "name": "query - 2" @@ -43917,6 +43923,7 @@ "query": "let UsbDriveMount = DeviceEvents\r\n| where ActionType==\"UsbDriveMounted\"\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\r\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\r\n| order by DeviceId asc, MountTime desc;\r\nlet FileCreation = DeviceFileEvents\r\n| where InitiatingProcessAccountName != \"system\"\r\n| where ActionType == \"FileCreated\"\r\n| where FolderPath !startswith \"C:\\\\\"\r\n| where FolderPath !startswith \"\\\\\"\r\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\r\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\r\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\r\n| order by DeviceId asc, Timestamp desc;\r\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\r\n| where FolderPath startswith DriveLetter\r\n| where Timestamp >= MountTime\r\n| partition by ReportId ( top 1 by MountTime )\r\n| order by DeviceId asc, Timestamp desc\r\n| summarize FileCount = count() by DeviceName\r\n| order by FileCount desc", "size": 1, "title": "Device where files are copied to USB Drive from TimeTange {TimeRange}", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { "formatters": [ @@ -43938,7 +43945,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mvexpand ConnectedNetworks\r\n| summarize count() by tostring(ConnectedNetworks.IsConnectedToInternet)", + "query": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mvexpand ConnectedNetworks\r\n| summarize count() by InternetConnectivity = coalesce(tostring(ConnectedNetworks.IsConnectedToInternet), \"Unknown\")", "size": 1, "title": "Device Internet Connectivity Status from TimeTange {TimeRange}", "timeContextFromParameter": "TimeRange", @@ -43964,7 +43971,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(Timestamp, DeviceName) by DeviceId\r\n| extend DeviceMachineName = split(DeviceName, '.')[0]\r\n| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)\r\n| summarize count() by DeviceDomain", + "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(Timestamp, DeviceName) by DeviceId\r\n| extend DeviceMachineName = split(DeviceName, '.')[0]\r\n| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)\r\n| summarize count() by DeviceDomain = coalesce(DeviceDomain, \"No DNS suffix\")", "size": 1, "title": "Device Count by DNS Suffix", "timeContextFromParameter": "TimeRange", @@ -43985,9 +43992,10 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by tostring(IsAzureADJoined)", + "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by EntraIDJoinStatus = coalesce(tostring(IsAzureADJoined), \"Unknown\")", "size": 1, "title": "Device EntraID Join status", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart", "gridSettings": { @@ -44071,6 +44079,7 @@ "query": "DeviceEvents\r\n| where ActionType startswith \"Asr\" and ActionType endswith \"Blocked\"\r\n// Count total stats - count events and machines per rule\r\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType", "size": 0, "title": "Get stats on ASR blocks - count events and machines per rule for {TimeRange}", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting" }, "name": "query - 1 - Copy" @@ -44133,6 +44142,7 @@ "query": "DeviceNetworkInfo\r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| summarize count() by MachineGroup", "size": 0, "title": "Count By Machine Group for {TimeRange}", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { "filter": true @@ -44185,7 +44195,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "// This query looks for Tor client, or for a common Tor plugin called Meek.\r\n// We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents)\r\n// To read more about this technique, see:\r\n// Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used\r\n// Meek plugin: https://attack.mitre.org/wiki/Software/S0175\r\n// Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188\r\n// Tags: #Tor, #MultiHopProxy, #CnC\r\nDeviceNetworkEvents \r\n| where Timestamp < ago(3d) and InitiatingProcessFileName in~ (\"tor.exe\", \"meek-client.exe\")\r\n// Returns MD5 hashes of files used by Tor, to enable you to block them.\r\n// We count how prevalent each file is (by machines) and show examples for some of them (up to 5 machine names per hash).\r\n| summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessMD5\r\n| order by MachineCount desc", + "query": "// This query looks for Tor client, or for a common Tor plugin called Meek.\r\n// We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents)\r\n// To read more about this technique, see:\r\n// Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used\r\n// Meek plugin: https://attack.mitre.org/wiki/Software/S0175\r\n// Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188\r\n// Tags: #Tor, #MultiHopProxy, #CnC\r\nDeviceNetworkEvents \r\n| where InitiatingProcessFileName in~ (\"tor.exe\", \"meek-client.exe\")\r\n// Returns MD5 hashes of files used by Tor, to enable you to block them.\r\n// We count how prevalent each file is (by machines) and show examples for some of them (up to 5 machine names per hash).\r\n| summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessMD5\r\n| order by MachineCount desc", "size": 0, "title": "Tor Clients for {TimeRange}", "timeContextFromParameter": "TimeRange", @@ -44225,9 +44235,10 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "DeviceFileEvents\r\n| summarize count() by InitiatingProcessAccountUpn", + "query": "DeviceFileEvents\r\n| summarize count() by InitiatingProcessAccountUpn = coalesce(InitiatingProcessAccountUpn, \"No UPN\")", "size": 0, "title": "Count by InitiatingProcessAccountUpn for {TimeRange}", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "unstackedbar" }, @@ -44247,9 +44258,9 @@ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", "contentProvenance": { "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender", - "packageVersion": "3.2.1", + "packageVersion": "3.2.2", "contentId": "05a7425a-fcda-5e24-823d-f8c9dd7a6215", - "contentVersion": "3.2.1" + "contentVersion": "3.2.2" } } } @@ -44269,7 +44280,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Defender Workbook: MicrosoftDefenderForEndPoint", + "description": "Defender Workbook: Microsoft Defender For EndPoint", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "languageVersion": "2.0", @@ -44286,7 +44297,7 @@ "type": "Microsoft.Security/workbooks@2026-06-01-preview", "properties": { "id": "4fffade5-9b6b-51af-a33d-97641e240595", - "name": "MicrosoftDefenderForEndPoint", + "name": "Microsoft Defender For EndPoint", "content": { "version": "Notebook/1.0", "items": [ @@ -44483,14 +44494,20 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let AllDeviceNames = DeviceInfo | distinct DeviceId, DeviceName;\nlet DeviceEventSummary = DeviceEvents | extend Type = \"DeviceEvents\" | summarize count() by DeviceId, Type, bin(TimeGenerated,1d);\nlet DeviceNetworkEventsSummary = DeviceNetworkEvents | extend Type = \"DeviceNetworkEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceNetworkInfoSummary = DeviceNetworkInfo | extend Type = \"DeviceNetworkInfo\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceLogonEventsSummary = DeviceLogonEvents | extend Type = \"DeviceLogonEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceRegistryEventsSummary = DeviceRegistryEvents | extend Type = \"DeviceRegistryEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceProcessEventsSummary = DeviceProcessEvents | extend Type = \"DeviceProcessEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\n(DeviceEventSummary\n| union DeviceNetworkEventsSummary,\nDeviceNetworkEventsSummary,\nDeviceNetworkInfoSummary,\nDeviceLogonEventsSummary,\nDeviceRegistryEventsSummary,\nDeviceProcessEventsSummary)\n| join kind=inner ( \nAllDeviceNames\n)\non $left.DeviceId == $right.DeviceId\n| project-reorder Type, TimeGenerated, count_\n//| project-away DeviceId, DeviceId1", + "query": "let AllDeviceNames = DeviceInfo | distinct DeviceId, DeviceName;\nlet DeviceEventSummary = DeviceEvents | extend Type = \"DeviceEvents\" | summarize count() by DeviceId, Type, bin(TimeGenerated,1d);\nlet DeviceNetworkEventsSummary = DeviceNetworkEvents | extend Type = \"DeviceNetworkEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceNetworkInfoSummary = DeviceNetworkInfo | extend Type = \"DeviceNetworkInfo\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceLogonEventsSummary = DeviceLogonEvents | extend Type = \"DeviceLogonEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceRegistryEventsSummary = DeviceRegistryEvents | extend Type = \"DeviceRegistryEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceProcessEventsSummary = DeviceProcessEvents | extend Type = \"DeviceProcessEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\n(DeviceEventSummary\n| union DeviceNetworkEventsSummary,\nDeviceNetworkInfoSummary,\nDeviceLogonEventsSummary,\nDeviceRegistryEventsSummary,\nDeviceProcessEventsSummary)\n| join kind=inner ( \nAllDeviceNames\n)\non $left.DeviceId == $right.DeviceId\n| project-reorder Type, TimeGenerated, count_\n//| project-away DeviceId, DeviceId1", "size": 1, "title": "Daily Data Flow on MDE Tables over {TimeRange}", "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "timechart", "chartSettings": { - "xAxis": "count_" + "xAxis": "TimeGenerated", + "yAxis": [ + "count_" + ], + "splitBy": [ + "Type" + ] } }, "name": "query - 2" @@ -44517,6 +44534,7 @@ "query": "let UsbDriveMount = DeviceEvents\r\n| where ActionType==\"UsbDriveMounted\"\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\r\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\r\n| order by DeviceId asc, MountTime desc;\r\nlet FileCreation = DeviceFileEvents\r\n| where InitiatingProcessAccountName != \"system\"\r\n| where ActionType == \"FileCreated\"\r\n| where FolderPath !startswith \"C:\\\\\"\r\n| where FolderPath !startswith \"\\\\\"\r\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\r\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\r\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\r\n| order by DeviceId asc, Timestamp desc;\r\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\r\n| where FolderPath startswith DriveLetter\r\n| where Timestamp >= MountTime\r\n| partition by ReportId ( top 1 by MountTime )\r\n| order by DeviceId asc, Timestamp desc\r\n| summarize FileCount = count() by DeviceName\r\n| order by FileCount desc", "size": 1, "title": "Device where files are copied to USB Drive from TimeTange {TimeRange}", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { "formatters": [ @@ -44538,7 +44556,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mvexpand ConnectedNetworks\r\n| summarize count() by tostring(ConnectedNetworks.IsConnectedToInternet)", + "query": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mvexpand ConnectedNetworks\r\n| summarize count() by InternetConnectivity = coalesce(tostring(ConnectedNetworks.IsConnectedToInternet), \"Unknown\")", "size": 1, "title": "Device Internet Connectivity Status from TimeTange {TimeRange}", "timeContextFromParameter": "TimeRange", @@ -44564,7 +44582,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(Timestamp, DeviceName) by DeviceId\r\n| extend DeviceMachineName = split(DeviceName, '.')[0]\r\n| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)\r\n| summarize count() by DeviceDomain", + "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(Timestamp, DeviceName) by DeviceId\r\n| extend DeviceMachineName = split(DeviceName, '.')[0]\r\n| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)\r\n| summarize count() by DeviceDomain = coalesce(DeviceDomain, \"No DNS suffix\")", "size": 1, "title": "Device Count by DNS Suffix", "timeContextFromParameter": "TimeRange", @@ -44585,9 +44603,10 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by tostring(IsAzureADJoined)", + "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by EntraIDJoinStatus = coalesce(tostring(IsAzureADJoined), \"Unknown\")", "size": 1, "title": "Device EntraID Join status", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart", "gridSettings": { @@ -44671,6 +44690,7 @@ "query": "DeviceEvents\r\n| where ActionType startswith \"Asr\" and ActionType endswith \"Blocked\"\r\n// Count total stats - count events and machines per rule\r\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType", "size": 0, "title": "Get stats on ASR blocks - count events and machines per rule for {TimeRange}", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting" }, "name": "query - 1 - Copy" @@ -44733,6 +44753,7 @@ "query": "DeviceNetworkInfo\r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| summarize count() by MachineGroup", "size": 0, "title": "Count By Machine Group for {TimeRange}", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { "filter": true @@ -44785,7 +44806,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "// This query looks for Tor client, or for a common Tor plugin called Meek.\r\n// We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents)\r\n// To read more about this technique, see:\r\n// Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used\r\n// Meek plugin: https://attack.mitre.org/wiki/Software/S0175\r\n// Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188\r\n// Tags: #Tor, #MultiHopProxy, #CnC\r\nDeviceNetworkEvents \r\n| where Timestamp < ago(3d) and InitiatingProcessFileName in~ (\"tor.exe\", \"meek-client.exe\")\r\n// Returns MD5 hashes of files used by Tor, to enable you to block them.\r\n// We count how prevalent each file is (by machines) and show examples for some of them (up to 5 machine names per hash).\r\n| summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessMD5\r\n| order by MachineCount desc", + "query": "// This query looks for Tor client, or for a common Tor plugin called Meek.\r\n// We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents)\r\n// To read more about this technique, see:\r\n// Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used\r\n// Meek plugin: https://attack.mitre.org/wiki/Software/S0175\r\n// Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188\r\n// Tags: #Tor, #MultiHopProxy, #CnC\r\nDeviceNetworkEvents \r\n| where InitiatingProcessFileName in~ (\"tor.exe\", \"meek-client.exe\")\r\n// Returns MD5 hashes of files used by Tor, to enable you to block them.\r\n// We count how prevalent each file is (by machines) and show examples for some of them (up to 5 machine names per hash).\r\n| summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessMD5\r\n| order by MachineCount desc", "size": 0, "title": "Tor Clients for {TimeRange}", "timeContextFromParameter": "TimeRange", @@ -44825,9 +44846,10 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "DeviceFileEvents\r\n| summarize count() by InitiatingProcessAccountUpn", + "query": "DeviceFileEvents\r\n| summarize count() by InitiatingProcessAccountUpn = coalesce(InitiatingProcessAccountUpn, \"No UPN\")", "size": 0, "title": "Count by InitiatingProcessAccountUpn for {TimeRange}", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "unstackedbar" }, @@ -44847,9 +44869,9 @@ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", "contentProvenance": { "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender", - "packageVersion": "3.2.1", + "packageVersion": "3.2.2", "contentId": "05a7425a-fcda-5e24-823d-f8c9dd7a6215", - "contentVersion": "3.2.1" + "contentVersion": "3.2.2" } } } @@ -44857,21 +44879,21 @@ } }, "packageKind": "Solution", - "packageVersion": "3.2.1", + "packageVersion": "3.2.2", "packageName": "Microsoft Defender XDR", "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender", "contentSchemaVersion": "3.0.0", "contentId": "05a7425a-fcda-5e24-823d-f8c9dd7a6215", "contentKind": "DefenderWorkbook", - "displayName": "MicrosoftDefenderForEndPoint", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','05a7425a-fcda-5e24-823d-f8c9dd7a6215','-','3.2.1')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','05a7425a-fcda-5e24-823d-f8c9dd7a6215','-','3.2.1')))]", - "version": "3.2.1", + "displayName": "Microsoft Defender For EndPoint", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','05a7425a-fcda-5e24-823d-f8c9dd7a6215','-','3.2.2')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','05a7425a-fcda-5e24-823d-f8c9dd7a6215','-','3.2.2')))]", + "version": "3.2.2", "contentProvenance": { "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender", - "packageVersion": "3.2.1", + "packageVersion": "3.2.2", "contentId": "05a7425a-fcda-5e24-823d-f8c9dd7a6215", - "contentVersion": "3.2.1", + "contentVersion": "3.2.2", "requiredWorkloads": [ { "workload": "mde", @@ -44923,7 +44945,7 @@ "type": "Microsoft.Security/workbooks@2026-06-01-preview", "properties": { "id": "baa399d3-2174-5938-b0b8-b91aed73090a", - "name": "MicrosoftDefenderForIdentity", + "name": "Microsoft Defender For Identity", "content": { "version": "Notebook/1.0", "items": [ @@ -45144,7 +45166,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityLogonEvents\r\n| summarize count() by Protocol", + "query": "IdentityLogonEvents\r\n| summarize count() by Protocol = coalesce(Protocol, \"Unknown\")", "size": 0, "title": "Log On Protocol", "timeContextFromParameter": "TimeRange", @@ -45172,9 +45194,10 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityQueryEvents\r\n| summarize count() by DestinationPort", + "query": "IdentityQueryEvents\r\n| summarize count() by DestinationPort = coalesce(tostring(DestinationPort), \"Unknown\")", "size": 0, "title": "Query Destination Port", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart" }, @@ -45209,7 +45232,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityDirectoryEvents\r\n| summarize count() by Protocol", + "query": "IdentityDirectoryEvents\r\n| summarize count() by Protocol = coalesce(Protocol, \"Unknown\")", "size": 0, "title": "Directory Events Protocol", "timeContextFromParameter": "TimeRange", @@ -45223,9 +45246,9 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityDirectoryEvents\r\n| summarize count() by AccountDomain", + "query": "IdentityDirectoryEvents\r\n| summarize count() by AccountDomain = coalesce(AccountDomain, \"Unknown\")", "size": 0, - "title": "Directory Events Protocol", + "title": "Directory Events Account Domain", "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart" @@ -45237,9 +45260,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityDirectoryEvents\r\n| where isnotempty(AccountUpn)\r\n| summarize count() by AccountUpn\r\n| order by count_ desc \r\n| take 10", + "query": "IdentityDirectoryEvents\r\n| extend Account = coalesce(AccountUpn, iff(isnotempty(AccountName) and isnotempty(AccountDomain), strcat(AccountDomain, \"\\\\\", AccountName), AccountName), tostring(AdditionalFields[\"ACTOR.ACCOUNT\"]), AccountSid)\r\n| where isnotempty(Account)\r\n| summarize count() by Account\r\n| order by count_ desc \r\n| take 10", "size": 0, "title": "Top 10 Accounts Activity", + "subtitle": "Account UPN, domain/name, actor account, or SID, in that order.", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "table", "gridSettings": { @@ -45312,6 +45337,7 @@ "query": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Resource access\"\r\n| extend TargetComputerOperatingSystem_ = tostring(AdditionalFields.TargetComputerOperatingSystem)\r\n| extend DestinationComputerOperatingSystem_ = tostring(AdditionalFields.DestinationComputerOperatingSystem)\r\n| extend Count_ = toint(AdditionalFields.Count)\r\n| summarize sum(Count_) by TargetComputerOperatingSystem_, DestinationComputerOperatingSystem_\r\n| order by sum_Count_ desc", "size": 0, "title": "Resource Access Summary in OS", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { "formatters": [ @@ -45342,6 +45368,7 @@ "query": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Credentials validation\"\r\n| extend FROM_DEVICE = tostring(AdditionalFields.[\"FROM.DEVICE\"])\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize sum(Count) by FROM_DEVICE, TO_DEVICE\r\n| order by sum_Count desc", "size": 0, "title": "Credentials validation Summary in Devices", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { "formatters": [ @@ -45415,7 +45442,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let data = IdentityLogonEvents;\r\ndata\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize LogonSuccess = sumif(Count,ActionType == \"LogonSuccess\"),LogonFailed= sumif(Count,ActionType == \"LogonFailed\") by AccountUpn\r\n| join kind = inner\r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\r\n) on $left.AccountUpn == $right.AccountUpn", + "query": "let data = IdentityLogonEvents\r\n| extend Count = coalesce(toint(AdditionalFields.Count), 1);\r\ndata\r\n| summarize LogonSuccess = sumif(Count,ActionType == \"LogonSuccess\"),LogonFailed= sumif(Count,ActionType == \"LogonFailed\") by AccountUpn\r\n| join kind = inner\r\n(\r\ndata\r\n| make-series Trend = sum(Count) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\r\n) on $left.AccountUpn == $right.AccountUpn", "size": 0, "title": "Logon Summary by Users", "timeContextFromParameter": "TimeRange", @@ -45535,6 +45562,7 @@ "query": "let data = IdentityQueryEvents;\r\ndata\r\n| summarize count() by DeviceName\r\n| join kind =inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceName\r\n) on $left.DeviceName == $right.DeviceName", "size": 0, "title": "Query Summary from Source Devices", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { "formatters": [ @@ -45592,7 +45620,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityDirectoryEvents\r\n| summarize count() by ActionType \r\n| order by count_ desc", + "query": "IdentityDirectoryEvents\r\n| summarize count() by ActionType \r\n| order by count_ desc\r\n| take 10", "size": 0, "title": "Top 10 Actions", "timeContextFromParameter": "TimeRange", @@ -45641,9 +45669,10 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityDirectoryEvents\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn", + "query": "IdentityDirectoryEvents\r\n| extend Account = coalesce(AccountUpn, iff(isnotempty(AccountName) and isnotempty(AccountDomain), strcat(AccountDomain, \"\\\\\", AccountName), AccountName), tostring(AdditionalFields[\"ACTOR.ACCOUNT\"]), AccountSid)\r\n| where isnotempty(Account)\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Account", "size": 0, "title": "Account Trend on Directory Events", + "subtitle": "Account UPN, domain/name, actor account, or SID, in that order.", "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "table", @@ -45709,7 +45738,8 @@ "version": "KqlItem/1.0", "query": "let data = SecurityAlert\r\n| where ProductName == \"Azure Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated,*) by SystemAlertId;\r\ndata\r\n| summarize count() by AlertName\r\n| join kind=inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AlertName\r\n) on AlertName", "size": 0, - "noDataMessage": "Alerts", + "title": "Alerts", + "noDataMessage": "No identity alerts found in the selected time range.", "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { @@ -45793,9 +45823,9 @@ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", "contentProvenance": { "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender", - "packageVersion": "3.2.1", + "packageVersion": "3.2.2", "contentId": "200c5dd2-9786-5619-8425-4508a238d76a", - "contentVersion": "3.2.1" + "contentVersion": "3.2.2" } } } @@ -45815,7 +45845,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Defender Workbook: MicrosoftDefenderForIdentity", + "description": "Defender Workbook: Microsoft Defender For Identity", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "languageVersion": "2.0", @@ -45832,7 +45862,7 @@ "type": "Microsoft.Security/workbooks@2026-06-01-preview", "properties": { "id": "baa399d3-2174-5938-b0b8-b91aed73090a", - "name": "MicrosoftDefenderForIdentity", + "name": "Microsoft Defender For Identity", "content": { "version": "Notebook/1.0", "items": [ @@ -46053,7 +46083,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityLogonEvents\r\n| summarize count() by Protocol", + "query": "IdentityLogonEvents\r\n| summarize count() by Protocol = coalesce(Protocol, \"Unknown\")", "size": 0, "title": "Log On Protocol", "timeContextFromParameter": "TimeRange", @@ -46081,9 +46111,10 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityQueryEvents\r\n| summarize count() by DestinationPort", + "query": "IdentityQueryEvents\r\n| summarize count() by DestinationPort = coalesce(tostring(DestinationPort), \"Unknown\")", "size": 0, "title": "Query Destination Port", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart" }, @@ -46118,7 +46149,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityDirectoryEvents\r\n| summarize count() by Protocol", + "query": "IdentityDirectoryEvents\r\n| summarize count() by Protocol = coalesce(Protocol, \"Unknown\")", "size": 0, "title": "Directory Events Protocol", "timeContextFromParameter": "TimeRange", @@ -46132,9 +46163,9 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityDirectoryEvents\r\n| summarize count() by AccountDomain", + "query": "IdentityDirectoryEvents\r\n| summarize count() by AccountDomain = coalesce(AccountDomain, \"Unknown\")", "size": 0, - "title": "Directory Events Protocol", + "title": "Directory Events Account Domain", "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart" @@ -46146,9 +46177,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityDirectoryEvents\r\n| where isnotempty(AccountUpn)\r\n| summarize count() by AccountUpn\r\n| order by count_ desc \r\n| take 10", + "query": "IdentityDirectoryEvents\r\n| extend Account = coalesce(AccountUpn, iff(isnotempty(AccountName) and isnotempty(AccountDomain), strcat(AccountDomain, \"\\\\\", AccountName), AccountName), tostring(AdditionalFields[\"ACTOR.ACCOUNT\"]), AccountSid)\r\n| where isnotempty(Account)\r\n| summarize count() by Account\r\n| order by count_ desc \r\n| take 10", "size": 0, "title": "Top 10 Accounts Activity", + "subtitle": "Account UPN, domain/name, actor account, or SID, in that order.", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "table", "gridSettings": { @@ -46221,6 +46254,7 @@ "query": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Resource access\"\r\n| extend TargetComputerOperatingSystem_ = tostring(AdditionalFields.TargetComputerOperatingSystem)\r\n| extend DestinationComputerOperatingSystem_ = tostring(AdditionalFields.DestinationComputerOperatingSystem)\r\n| extend Count_ = toint(AdditionalFields.Count)\r\n| summarize sum(Count_) by TargetComputerOperatingSystem_, DestinationComputerOperatingSystem_\r\n| order by sum_Count_ desc", "size": 0, "title": "Resource Access Summary in OS", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { "formatters": [ @@ -46251,6 +46285,7 @@ "query": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Credentials validation\"\r\n| extend FROM_DEVICE = tostring(AdditionalFields.[\"FROM.DEVICE\"])\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize sum(Count) by FROM_DEVICE, TO_DEVICE\r\n| order by sum_Count desc", "size": 0, "title": "Credentials validation Summary in Devices", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { "formatters": [ @@ -46324,7 +46359,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let data = IdentityLogonEvents;\r\ndata\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize LogonSuccess = sumif(Count,ActionType == \"LogonSuccess\"),LogonFailed= sumif(Count,ActionType == \"LogonFailed\") by AccountUpn\r\n| join kind = inner\r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\r\n) on $left.AccountUpn == $right.AccountUpn", + "query": "let data = IdentityLogonEvents\r\n| extend Count = coalesce(toint(AdditionalFields.Count), 1);\r\ndata\r\n| summarize LogonSuccess = sumif(Count,ActionType == \"LogonSuccess\"),LogonFailed= sumif(Count,ActionType == \"LogonFailed\") by AccountUpn\r\n| join kind = inner\r\n(\r\ndata\r\n| make-series Trend = sum(Count) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\r\n) on $left.AccountUpn == $right.AccountUpn", "size": 0, "title": "Logon Summary by Users", "timeContextFromParameter": "TimeRange", @@ -46444,6 +46479,7 @@ "query": "let data = IdentityQueryEvents;\r\ndata\r\n| summarize count() by DeviceName\r\n| join kind =inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceName\r\n) on $left.DeviceName == $right.DeviceName", "size": 0, "title": "Query Summary from Source Devices", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { "formatters": [ @@ -46501,7 +46537,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityDirectoryEvents\r\n| summarize count() by ActionType \r\n| order by count_ desc", + "query": "IdentityDirectoryEvents\r\n| summarize count() by ActionType \r\n| order by count_ desc\r\n| take 10", "size": 0, "title": "Top 10 Actions", "timeContextFromParameter": "TimeRange", @@ -46550,9 +46586,10 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityDirectoryEvents\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn", + "query": "IdentityDirectoryEvents\r\n| extend Account = coalesce(AccountUpn, iff(isnotempty(AccountName) and isnotempty(AccountDomain), strcat(AccountDomain, \"\\\\\", AccountName), AccountName), tostring(AdditionalFields[\"ACTOR.ACCOUNT\"]), AccountSid)\r\n| where isnotempty(Account)\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Account", "size": 0, "title": "Account Trend on Directory Events", + "subtitle": "Account UPN, domain/name, actor account, or SID, in that order.", "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "table", @@ -46618,7 +46655,8 @@ "version": "KqlItem/1.0", "query": "let data = SecurityAlert\r\n| where ProductName == \"Azure Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated,*) by SystemAlertId;\r\ndata\r\n| summarize count() by AlertName\r\n| join kind=inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AlertName\r\n) on AlertName", "size": 0, - "noDataMessage": "Alerts", + "title": "Alerts", + "noDataMessage": "No identity alerts found in the selected time range.", "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { @@ -46702,9 +46740,9 @@ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json", "contentProvenance": { "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender", - "packageVersion": "3.2.1", + "packageVersion": "3.2.2", "contentId": "200c5dd2-9786-5619-8425-4508a238d76a", - "contentVersion": "3.2.1" + "contentVersion": "3.2.2" } } } @@ -46712,21 +46750,21 @@ } }, "packageKind": "Solution", - "packageVersion": "3.2.1", + "packageVersion": "3.2.2", "packageName": "Microsoft Defender XDR", "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender", "contentSchemaVersion": "3.0.0", "contentId": "200c5dd2-9786-5619-8425-4508a238d76a", "contentKind": "DefenderWorkbook", - "displayName": "MicrosoftDefenderForIdentity", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','200c5dd2-9786-5619-8425-4508a238d76a','-','3.2.1')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','200c5dd2-9786-5619-8425-4508a238d76a','-','3.2.1')))]", - "version": "3.2.1", + "displayName": "Microsoft Defender For Identity", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','200c5dd2-9786-5619-8425-4508a238d76a','-','3.2.2')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','200c5dd2-9786-5619-8425-4508a238d76a','-','3.2.2')))]", + "version": "3.2.2", "contentProvenance": { "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender", - "packageVersion": "3.2.1", + "packageVersion": "3.2.2", "contentId": "200c5dd2-9786-5619-8425-4508a238d76a", - "contentVersion": "3.2.1", + "contentVersion": "3.2.2", "requiredWorkloads": [ { "workload": "mdi", @@ -46784,14 +46822,14 @@ "type": "Microsoft.Security/workbooks@2026-06-01-preview", "properties": { "id": "8f47d55b-34a6-5d13-a89f-315b1a2a4f53", - "name": "MicrosoftDefenderForOffice365detectionsandinsights", + "name": "Microsoft Defender for Office 365 Detections and Insights", "content": { "version": "Notebook/1.0", "items": [ { "type": 1, "content": { - "json": "\n\n \n \n \n \n
\n Microsoft Defender for Office 365 Detections and Insights\n \n \n\t
\n\n\n\n\n
This workbook template provides an example of how to visualise and gain insights into Microsoft Defender for Office 365.
It allows you to visualise Microsoft Defender for Office 365 (MDO) data based on your organisation needs.
The workbook uses data from hunting tables streamed from Microsoft Defender XDR via the Microsoft Sentinel Connector. Keep the data in the Log Analytics workspace for as long as necessary to get insights over an extended period, based on your organisation's needs.
\n\n> \n**Please note:** *The workbook has a total of 14 tabs. If not all tabs are visible, you can access the remaining tabs using the \"...\" located at the end of the tab list on the right side.*\n> \n\n---\n\n\n\n> **Multi-tenant / multi-workspace:** select one or more workspaces in the **Workspace** filter to view data across them in a single view. For cross-tenant (MSSP) scenarios, onboard customer tenants with **Azure Lighthouse** (their workspaces then appear in the selectors) or use **Microsoft Defender multi-tenant management** in the Defender portal. For performance, keep to ~5–10 workspaces per view." + "json": "\n\n \n \n \n \n
\n Microsoft Defender for Office 365 Detections and Insights\n \n \n\t
\n\n\n\n\n
This workbook template provides an example of how to visualise and gain insights into Microsoft Defender for Office 365.
It allows you to visualise Microsoft Defender for Office 365 (MDO) data based on your organisation needs.
The workbook queries Microsoft Defender XDR advanced hunting tables in the Defender portal. Available data depends on your licensing, permissions, connected data sources and retention.
\n\n> \n**Please note:** *The workbook has a total of 14 tabs. If not all tabs are visible, you can access the remaining tabs using the \"...\" located at the end of the tab list on the right side.*\n> \n\n---\n\n> **Scope and filters:** use **TimeRange** and **Trend interval** to control the period and trend grouping. This XDR workbook does not provide a Workspace selector. Query scope follows the Defender portal's current data access context." }, "name": "text - 2", "id": "d2b45ab8-a1c1-43d2-853d-290640bf4c94" @@ -55537,7 +55575,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", + "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, Subject, TeamsMessageId", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", @@ -55564,7 +55602,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", + "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, Subject, TeamsMessageId", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", @@ -60566,7 +60604,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "// Identify MDO-related SecurityIncident IDs via alert correlation\r\nlet EmailSecurityIncidents = \r\n SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for MDO-related incidents\r\nlet LatestMdoIncidents =\r\n SecurityIncident\r\n | summarize arg_max(TimeGenerated, Classification, Status, IncidentName) by ProviderIncidentId\r\n | where ProviderIncidentId in (EmailSecurityIncidents)\r\n // Exclude other non-email incidents (e.g., DSPM with specific naming pattern)\r\n | where not(IncidentName startswith \"CC_\");\r\n\r\n// Compute true positive rate among closed MDO incidents\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| summarize\r\n TruePositiveCount = countif(Classification == \"TruePositive\"),\r\n TotalClosed = count()\r\n| extend TruePositiveRate = iff(\r\n TotalClosed > 0,\r\n TruePositiveCount * 100.0 / TotalClosed,\r\n real(null)\r\n)", + "query": "// Identify MDO-related SecurityIncident IDs via alert correlation\r\nlet EmailSecurityIncidents = \r\n SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for MDO-related incidents\r\nlet LatestMdoIncidents =\r\n SecurityIncident\r\n | summarize arg_max(TimeGenerated, Classification, Status, Title) by ProviderIncidentId\r\n | where ProviderIncidentId in (EmailSecurityIncidents)\r\n // Exclude other non-email incidents (e.g., DSPM with specific naming pattern)\r\n | where not(Title startswith \"CC_\");\r\n\r\n// Compute true positive rate among closed MDO incidents\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| summarize\r\n TruePositiveCount = countif(Classification == \"TruePositive\"),\r\n TotalClosed = count()\r\n| extend TruePositiveRate = iff(\r\n TotalClosed > 0,\r\n TruePositiveCount * 100.0 / TotalClosed,\r\n real(null)\r\n)", "size": 1, "showAnalytics": true, "timeContextFromParameter": "TimeRange", @@ -60610,6 +60648,7 @@ "query": "//This queries shows the last activity on the Incident and attempts to display auto resolved incidents vs manual interaction.\r\n//Add strings for your automations if you rely on any other application/system\r\n//Fewer human-closed incidents (and a higher automated closure rate) generally indicates greater SecOps efficiency, as automation is successfully handling more work.\r\n\r\n// Identify MDO-related incidents by joining SecurityIncident and SecurityAlert\r\nlet EmailSecurityIncidents = SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get latest status of each incident and count closed incidents by who closed them\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\r\n| where ProviderIncidentId in (EmailSecurityIncidents)\r\n| where Status == 'Closed'\r\n| where not(Title startswith \"CC_\") // Exclude non-MDO incidents from DSPM policies\r\n| extend ClosedBy = iff( // Add strings for your automation systems\r\n tolower(ModifiedBy) has_any (\"system\",\"azure\",\"automation\",\"playbook\",\"microsoft xdr\",\"microsoft defender xdr\",\"created from alert\"),\r\n \"Automated\",\r\n \"Human\"\r\n )\r\n| summarize ClosedCount = count() by ClosedBy", "size": 3, "showAnalytics": true, + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart" }, @@ -60807,6 +60846,7 @@ "query": "//This query shows if the action taken after an Automated Investigation required manual approval by and admin or was automatically taken\r\nEmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionType == \"Automated Remediation\"\r\n| summarize count() by ActionTrigger", "size": 3, "showAnalytics": true, + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart" }, @@ -61043,9 +61083,9 @@ "fromTemplateId": "sentinel-MicrosoftDefenderForOffice365detectionsandinsights", "contentProvenance": { "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender", - "packageVersion": "3.2.1", + "packageVersion": "3.2.2", "contentId": "e39952df-ba60-50cf-80f6-76f7a2ebf57c", - "contentVersion": "3.2.1" + "contentVersion": "3.2.2" } } } @@ -61065,7 +61105,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Defender Workbook: MicrosoftDefenderForOffice365detectionsandinsights", + "description": "Defender Workbook: Microsoft Defender for Office 365 Detections and Insights", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "languageVersion": "2.0", @@ -61082,14 +61122,14 @@ "type": "Microsoft.Security/workbooks@2026-06-01-preview", "properties": { "id": "8f47d55b-34a6-5d13-a89f-315b1a2a4f53", - "name": "MicrosoftDefenderForOffice365detectionsandinsights", + "name": "Microsoft Defender for Office 365 Detections and Insights", "content": { "version": "Notebook/1.0", "items": [ { "type": 1, "content": { - "json": "\n\n \n \n \n \n
\n Microsoft Defender for Office 365 Detections and Insights\n \n \n\t
\n\n\n\n\n
This workbook template provides an example of how to visualise and gain insights into Microsoft Defender for Office 365.
It allows you to visualise Microsoft Defender for Office 365 (MDO) data based on your organisation needs.
The workbook uses data from hunting tables streamed from Microsoft Defender XDR via the Microsoft Sentinel Connector. Keep the data in the Log Analytics workspace for as long as necessary to get insights over an extended period, based on your organisation's needs.
\n\n> \n**Please note:** *The workbook has a total of 14 tabs. If not all tabs are visible, you can access the remaining tabs using the \"...\" located at the end of the tab list on the right side.*\n> \n\n---\n\n\n\n> **Multi-tenant / multi-workspace:** select one or more workspaces in the **Workspace** filter to view data across them in a single view. For cross-tenant (MSSP) scenarios, onboard customer tenants with **Azure Lighthouse** (their workspaces then appear in the selectors) or use **Microsoft Defender multi-tenant management** in the Defender portal. For performance, keep to ~5–10 workspaces per view." + "json": "\n\n \n \n \n \n
\n Microsoft Defender for Office 365 Detections and Insights\n \n \n\t
\n\n\n\n\n
This workbook template provides an example of how to visualise and gain insights into Microsoft Defender for Office 365.
It allows you to visualise Microsoft Defender for Office 365 (MDO) data based on your organisation needs.
The workbook queries Microsoft Defender XDR advanced hunting tables in the Defender portal. Available data depends on your licensing, permissions, connected data sources and retention.
\n\n> \n**Please note:** *The workbook has a total of 14 tabs. If not all tabs are visible, you can access the remaining tabs using the \"...\" located at the end of the tab list on the right side.*\n> \n\n---\n\n> **Scope and filters:** use **TimeRange** and **Trend interval** to control the period and trend grouping. This XDR workbook does not provide a Workspace selector. Query scope follows the Defender portal's current data access context." }, "name": "text - 2", "id": "d2b45ab8-a1c1-43d2-853d-290640bf4c94" @@ -69835,7 +69875,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", + "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, Subject, TeamsMessageId", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", @@ -69862,7 +69902,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", + "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, Subject, TeamsMessageId", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", @@ -74864,7 +74904,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "// Identify MDO-related SecurityIncident IDs via alert correlation\r\nlet EmailSecurityIncidents = \r\n SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for MDO-related incidents\r\nlet LatestMdoIncidents =\r\n SecurityIncident\r\n | summarize arg_max(TimeGenerated, Classification, Status, IncidentName) by ProviderIncidentId\r\n | where ProviderIncidentId in (EmailSecurityIncidents)\r\n // Exclude other non-email incidents (e.g., DSPM with specific naming pattern)\r\n | where not(IncidentName startswith \"CC_\");\r\n\r\n// Compute true positive rate among closed MDO incidents\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| summarize\r\n TruePositiveCount = countif(Classification == \"TruePositive\"),\r\n TotalClosed = count()\r\n| extend TruePositiveRate = iff(\r\n TotalClosed > 0,\r\n TruePositiveCount * 100.0 / TotalClosed,\r\n real(null)\r\n)", + "query": "// Identify MDO-related SecurityIncident IDs via alert correlation\r\nlet EmailSecurityIncidents = \r\n SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for MDO-related incidents\r\nlet LatestMdoIncidents =\r\n SecurityIncident\r\n | summarize arg_max(TimeGenerated, Classification, Status, Title) by ProviderIncidentId\r\n | where ProviderIncidentId in (EmailSecurityIncidents)\r\n // Exclude other non-email incidents (e.g., DSPM with specific naming pattern)\r\n | where not(Title startswith \"CC_\");\r\n\r\n// Compute true positive rate among closed MDO incidents\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| summarize\r\n TruePositiveCount = countif(Classification == \"TruePositive\"),\r\n TotalClosed = count()\r\n| extend TruePositiveRate = iff(\r\n TotalClosed > 0,\r\n TruePositiveCount * 100.0 / TotalClosed,\r\n real(null)\r\n)", "size": 1, "showAnalytics": true, "timeContextFromParameter": "TimeRange", @@ -74908,6 +74948,7 @@ "query": "//This queries shows the last activity on the Incident and attempts to display auto resolved incidents vs manual interaction.\r\n//Add strings for your automations if you rely on any other application/system\r\n//Fewer human-closed incidents (and a higher automated closure rate) generally indicates greater SecOps efficiency, as automation is successfully handling more work.\r\n\r\n// Identify MDO-related incidents by joining SecurityIncident and SecurityAlert\r\nlet EmailSecurityIncidents = SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get latest status of each incident and count closed incidents by who closed them\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\r\n| where ProviderIncidentId in (EmailSecurityIncidents)\r\n| where Status == 'Closed'\r\n| where not(Title startswith \"CC_\") // Exclude non-MDO incidents from DSPM policies\r\n| extend ClosedBy = iff( // Add strings for your automation systems\r\n tolower(ModifiedBy) has_any (\"system\",\"azure\",\"automation\",\"playbook\",\"microsoft xdr\",\"microsoft defender xdr\",\"created from alert\"),\r\n \"Automated\",\r\n \"Human\"\r\n )\r\n| summarize ClosedCount = count() by ClosedBy", "size": 3, "showAnalytics": true, + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart" }, @@ -75105,6 +75146,7 @@ "query": "//This query shows if the action taken after an Automated Investigation required manual approval by and admin or was automatically taken\r\nEmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionType == \"Automated Remediation\"\r\n| summarize count() by ActionTrigger", "size": 3, "showAnalytics": true, + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart" }, @@ -75341,9 +75383,9 @@ "fromTemplateId": "sentinel-MicrosoftDefenderForOffice365detectionsandinsights", "contentProvenance": { "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender", - "packageVersion": "3.2.1", + "packageVersion": "3.2.2", "contentId": "e39952df-ba60-50cf-80f6-76f7a2ebf57c", - "contentVersion": "3.2.1" + "contentVersion": "3.2.2" } } } @@ -75351,21 +75393,21 @@ } }, "packageKind": "Solution", - "packageVersion": "3.2.1", + "packageVersion": "3.2.2", "packageName": "Microsoft Defender XDR", "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender", "contentSchemaVersion": "3.0.0", "contentId": "e39952df-ba60-50cf-80f6-76f7a2ebf57c", "contentKind": "DefenderWorkbook", - "displayName": "MicrosoftDefenderForOffice365detectionsandinsights", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','e39952df-ba60-50cf-80f6-76f7a2ebf57c','-','3.2.1')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','e39952df-ba60-50cf-80f6-76f7a2ebf57c','-','3.2.1')))]", - "version": "3.2.1", + "displayName": "Microsoft Defender for Office 365 Detections and Insights", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','e39952df-ba60-50cf-80f6-76f7a2ebf57c','-','3.2.2')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','dwb','-', uniqueString(concat(variables('_solutionId'),'-','DefenderWorkbook','-','e39952df-ba60-50cf-80f6-76f7a2ebf57c','-','3.2.2')))]", + "version": "3.2.2", "contentProvenance": { "packageId": "azuresentinel.azure-sentinel-solution-microsoft365defender", - "packageVersion": "3.2.1", + "packageVersion": "3.2.2", "contentId": "e39952df-ba60-50cf-80f6-76f7a2ebf57c", - "contentVersion": "3.2.1", + "contentVersion": "3.2.2", "requiredWorkloads": [ { "workload": "mdo", @@ -75395,7 +75437,8 @@ { "workload": "sentinel", "dataTypes": [ - "SecurityAlert" + "SecurityAlert", + "SecurityIncident" ] } ], @@ -75403,7 +75446,8 @@ { "connectorId": "MicrosoftThreatProtection", "dataTypes": [ - "SecurityAlert" + "SecurityAlert", + "SecurityIncident" ] } ], diff --git a/Solutions/Microsoft Defender XDR/ReleaseNotes.md b/Solutions/Microsoft Defender XDR/ReleaseNotes.md index cb5ecda615b..2a4a9c2de35 100644 --- a/Solutions/Microsoft Defender XDR/ReleaseNotes.md +++ b/Solutions/Microsoft Defender XDR/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |--------------|--------------------------------|---------------------------------------------------------------------------------------| +| 3.2.2 | 15-10-2026 | Fixed queries, time filters and charts in **XDR Workbooks**. | | 3.2.1 | 15-10-2026 | Added 3 **XDR Workbooks** alongside the existing Sentinel workbooks. | | 3.0.18 | 03-09-2026 | Added 57 new **Hunting Queries** for Microsoft Defender for Office 365 email and collaboration protection. Updated the **Workbook** Microsoft Defender for Office 365 Detections and Insights to version 4.0.0, adding Microsoft Teams collaboration and file malware coverage, and additional Advanced Hunting data types. | | 3.0.17 | 12-08-2026 | Updated **Analytic Rule** AnomalousVoulmeOfFileDeletion.yaml to add `AzureActiveDirectory` connector with `SigninLogs` data type. Fixed deploy button URLs in **Playbook** AttackSimulatorTrainingNonReporters readme to include the correct 'master' branch path. | diff --git a/Solutions/Microsoft Defender XDR/SolutionMetadata.json b/Solutions/Microsoft Defender XDR/SolutionMetadata.json index dfd105b845c..9bbd5dcd61d 100644 --- a/Solutions/Microsoft Defender XDR/SolutionMetadata.json +++ b/Solutions/Microsoft Defender XDR/SolutionMetadata.json @@ -18,5 +18,5 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" }, - "version": "3.2.1" + "version": "3.2.2" } diff --git a/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForEndPoint.json b/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForEndPoint.json index 2a99e786b21..13f63ae868e 100644 --- a/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForEndPoint.json +++ b/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForEndPoint.json @@ -194,14 +194,20 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let AllDeviceNames = DeviceInfo | distinct DeviceId, DeviceName;\nlet DeviceEventSummary = DeviceEvents | extend Type = \"DeviceEvents\" | summarize count() by DeviceId, Type, bin(TimeGenerated,1d);\nlet DeviceNetworkEventsSummary = DeviceNetworkEvents | extend Type = \"DeviceNetworkEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceNetworkInfoSummary = DeviceNetworkInfo | extend Type = \"DeviceNetworkInfo\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceLogonEventsSummary = DeviceLogonEvents | extend Type = \"DeviceLogonEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceRegistryEventsSummary = DeviceRegistryEvents | extend Type = \"DeviceRegistryEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceProcessEventsSummary = DeviceProcessEvents | extend Type = \"DeviceProcessEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\n(DeviceEventSummary\n| union DeviceNetworkEventsSummary,\nDeviceNetworkEventsSummary,\nDeviceNetworkInfoSummary,\nDeviceLogonEventsSummary,\nDeviceRegistryEventsSummary,\nDeviceProcessEventsSummary)\n| join kind=inner ( \nAllDeviceNames\n)\non $left.DeviceId == $right.DeviceId\n| project-reorder Type, TimeGenerated, count_\n//| project-away DeviceId, DeviceId1", + "query": "let AllDeviceNames = DeviceInfo | distinct DeviceId, DeviceName;\nlet DeviceEventSummary = DeviceEvents | extend Type = \"DeviceEvents\" | summarize count() by DeviceId, Type, bin(TimeGenerated,1d);\nlet DeviceNetworkEventsSummary = DeviceNetworkEvents | extend Type = \"DeviceNetworkEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceNetworkInfoSummary = DeviceNetworkInfo | extend Type = \"DeviceNetworkInfo\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceLogonEventsSummary = DeviceLogonEvents | extend Type = \"DeviceLogonEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceRegistryEventsSummary = DeviceRegistryEvents | extend Type = \"DeviceRegistryEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceProcessEventsSummary = DeviceProcessEvents | extend Type = \"DeviceProcessEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\n(DeviceEventSummary\n| union DeviceNetworkEventsSummary,\nDeviceNetworkInfoSummary,\nDeviceLogonEventsSummary,\nDeviceRegistryEventsSummary,\nDeviceProcessEventsSummary)\n| join kind=inner ( \nAllDeviceNames\n)\non $left.DeviceId == $right.DeviceId\n| project-reorder Type, TimeGenerated, count_\n//| project-away DeviceId, DeviceId1", "size": 1, "title": "Daily Data Flow on MDE Tables over {TimeRange}", "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "timechart", "chartSettings": { - "xAxis": "count_" + "xAxis": "TimeGenerated", + "yAxis": [ + "count_" + ], + "splitBy": [ + "Type" + ] } }, "name": "query - 2" @@ -228,6 +234,7 @@ "query": "let UsbDriveMount = DeviceEvents\r\n| where ActionType==\"UsbDriveMounted\"\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\r\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\r\n| order by DeviceId asc, MountTime desc;\r\nlet FileCreation = DeviceFileEvents\r\n| where InitiatingProcessAccountName != \"system\"\r\n| where ActionType == \"FileCreated\"\r\n| where FolderPath !startswith \"C:\\\\\"\r\n| where FolderPath !startswith \"\\\\\"\r\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\r\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\r\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\r\n| order by DeviceId asc, Timestamp desc;\r\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\r\n| where FolderPath startswith DriveLetter\r\n| where Timestamp >= MountTime\r\n| partition by ReportId ( top 1 by MountTime )\r\n| order by DeviceId asc, Timestamp desc\r\n| summarize FileCount = count() by DeviceName\r\n| order by FileCount desc", "size": 1, "title": "Device where files are copied to USB Drive from TimeTange {TimeRange}", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { "formatters": [ @@ -249,7 +256,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mvexpand ConnectedNetworks\r\n| summarize count() by tostring(ConnectedNetworks.IsConnectedToInternet)", + "query": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mvexpand ConnectedNetworks\r\n| summarize count() by InternetConnectivity = coalesce(tostring(ConnectedNetworks.IsConnectedToInternet), \"Unknown\")", "size": 1, "title": "Device Internet Connectivity Status from TimeTange {TimeRange}", "timeContextFromParameter": "TimeRange", @@ -275,7 +282,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(Timestamp, DeviceName) by DeviceId\r\n| extend DeviceMachineName = split(DeviceName, '.')[0]\r\n| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)\r\n| summarize count() by DeviceDomain", + "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(Timestamp, DeviceName) by DeviceId\r\n| extend DeviceMachineName = split(DeviceName, '.')[0]\r\n| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)\r\n| summarize count() by DeviceDomain = coalesce(DeviceDomain, \"No DNS suffix\")", "size": 1, "title": "Device Count by DNS Suffix", "timeContextFromParameter": "TimeRange", @@ -296,9 +303,10 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by tostring(IsAzureADJoined)", + "query": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by EntraIDJoinStatus = coalesce(tostring(IsAzureADJoined), \"Unknown\")", "size": 1, "title": "Device EntraID Join status", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart", "gridSettings": { @@ -382,6 +390,7 @@ "query": "DeviceEvents\r\n| where ActionType startswith \"Asr\" and ActionType endswith \"Blocked\"\r\n// Count total stats - count events and machines per rule\r\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType", "size": 0, "title": "Get stats on ASR blocks - count events and machines per rule for {TimeRange}", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting" }, "name": "query - 1 - Copy" @@ -444,6 +453,7 @@ "query": "DeviceNetworkInfo\r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| summarize count() by MachineGroup", "size": 0, "title": "Count By Machine Group for {TimeRange}", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { "filter": true @@ -496,7 +506,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "// This query looks for Tor client, or for a common Tor plugin called Meek.\r\n// We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents)\r\n// To read more about this technique, see:\r\n// Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used\r\n// Meek plugin: https://attack.mitre.org/wiki/Software/S0175\r\n// Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188\r\n// Tags: #Tor, #MultiHopProxy, #CnC\r\nDeviceNetworkEvents \r\n| where Timestamp < ago(3d) and InitiatingProcessFileName in~ (\"tor.exe\", \"meek-client.exe\")\r\n// Returns MD5 hashes of files used by Tor, to enable you to block them.\r\n// We count how prevalent each file is (by machines) and show examples for some of them (up to 5 machine names per hash).\r\n| summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessMD5\r\n| order by MachineCount desc", + "query": "// This query looks for Tor client, or for a common Tor plugin called Meek.\r\n// We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents)\r\n// To read more about this technique, see:\r\n// Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used\r\n// Meek plugin: https://attack.mitre.org/wiki/Software/S0175\r\n// Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188\r\n// Tags: #Tor, #MultiHopProxy, #CnC\r\nDeviceNetworkEvents \r\n| where InitiatingProcessFileName in~ (\"tor.exe\", \"meek-client.exe\")\r\n// Returns MD5 hashes of files used by Tor, to enable you to block them.\r\n// We count how prevalent each file is (by machines) and show examples for some of them (up to 5 machine names per hash).\r\n| summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessMD5\r\n| order by MachineCount desc", "size": 0, "title": "Tor Clients for {TimeRange}", "timeContextFromParameter": "TimeRange", @@ -536,9 +546,10 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "DeviceFileEvents\r\n| summarize count() by InitiatingProcessAccountUpn", + "query": "DeviceFileEvents\r\n| summarize count() by InitiatingProcessAccountUpn = coalesce(InitiatingProcessAccountUpn, \"No UPN\")", "size": 0, "title": "Count by InitiatingProcessAccountUpn for {TimeRange}", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "unstackedbar" }, @@ -559,3313 +570,13 @@ "xdrMetadata": { "contentId": "05a7425a-fcda-5e24-823d-f8c9dd7a6215", "instanceId": "4fffade5-9b6b-51af-a33d-97641e240595", - "version": "3.2.1", + "version": "3.2.2", "schemaVersion": "1.0.0", - "displayName": "MicrosoftDefenderForEndPoint" + "displayName": "Microsoft Defender For EndPoint" }, "contentProvenance": { - "source": { - "path": "Workbooks/MicrosoftDefenderForEndPoint.json", - "sha256": "c78f1eb16db8df47a263a39839809e2d98feb3cfb1dc5bcdc7da5c8863aff74a", - "contentId": "sentinel-MicrosoftDefenderForEndPoint", - "originalMetadataVersion": null - }, - "conversion": { - "tool": "sentinel-xdr-migration", - "version": "0.1.0", - "reviewRequired": false, - "queries": [ - { - "sourcePath": "/items/4/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "cb071c1659672fa84632cfaacb3165d49765a22282541afece8c51bba08f4b54" - }, - "conversion": { - "sourceId": "/items/4/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "union \r\nisfuzzy = true\r\n(DeviceInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type= \"DeviceInfo\" | extend Description = \"Machine information (including OS information)\"),\r\n(DeviceNetworkInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceNetworkInfo\" | extend Description = \"Network properties of machines\"),\r\n(DeviceProcessEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceProcessEvents\" | extend Description = \"Process creation and related events\"),\r\n(DeviceNetworkEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceNetworkEvents\" | extend Description = \"Network connection and related events\"),\r\n(DeviceFileEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceFileEvents\" | extend Description = \"File creation, modification, and other file system events\"),\r\n(DeviceRegistryEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceRegistryEvents\" | extend Description = \"Creation and modification of registry entries\"),\r\n(DeviceLogonEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceLogonEvents\" | extend Description = \"Sign-ins and other authentication events\"),\r\n(DeviceImageLoadEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceImageLoadEvents\" | extend Description = \"DLL loading events\"),\r\n(DeviceEvents | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceEvents\" | extend Description = \"Additional events types\"),\r\n(DeviceFileCertificateInfo | summarize arg_max(TimeGenerated,*) | project TimeGenerated, Type=\"DeviceFileCertificateInfo\" | extend Description = \"Certificate information of signed files)\")\r\n| extend [\"Last Log Received At (Local Time)\"] = TimeGenerated\r\n| project Type, Description, [\"Last Log Received At (Local Time)\"]", - "resolvedTables": [ - "DeviceEvents", - "DeviceFileCertificateInfo", - "DeviceFileEvents", - "DeviceImageLoadEvents", - "DeviceInfo", - "DeviceLogonEvents", - "DeviceNetworkEvents", - "DeviceNetworkInfo", - "DeviceProcessEvents", - "DeviceRegistryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceEvents", - "ahTable": "DeviceEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 67, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceFileCertificateInfo", - "ahTable": "DeviceFileCertificateInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 20, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceFileEvents", - "ahTable": "DeviceFileEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 60, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceImageLoadEvents", - "ahTable": "DeviceImageLoadEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 44, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceInfo", - "ahTable": "DeviceInfo", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AadDeviceId", - "ah": "AadDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AssetValue", - "ah": "AssetValue", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AwsResourceName", - "ah": "AwsResourceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureResourceId", - "ah": "AzureResourceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureVmId", - "ah": "AzureVmId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureVmSubscriptionId", - "ah": "AzureVmSubscriptionId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ClientVersion", - "ah": "ClientVersion", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "CloudPlatforms", - "ah": "CloudPlatforms", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceCategory", - "ah": "DeviceCategory", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceDynamicTags", - "ah": "DeviceDynamicTags", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceId", - "ah": "DeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceManualTags", - "ah": "DeviceManualTags", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceObjectId", - "laType": "string", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "DeviceSubtype", - "ah": "DeviceSubtype", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceType", - "ah": "DeviceType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ExclusionReason", - "ah": "ExclusionReason", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ExposureLevel", - "ah": "ExposureLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "GcpFullResourceName", - "ah": "GcpFullResourceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "HardwareUuid", - "ah": "HardwareUuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "HostDeviceId", - "ah": "HostDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsAzureADJoined", - "ah": "IsAzureADJoined", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsExcluded", - "ah": "IsExcluded", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsInternetFacing", - "ah": "IsInternetFacing", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsTransient", - "ah": "IsTransient", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "JoinType", - "ah": "JoinType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LoggedOnUsers", - "ah": "LoggedOnUsers", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "MachineGroup", - "ah": "MachineGroup", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MergedDeviceIds", - "ah": "MergedDeviceIds", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MergedToDeviceId", - "ah": "MergedToDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MitigationStatus", - "ah": "MitigationStatus", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Model", - "ah": "Model", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSArchitecture", - "ah": "OSArchitecture", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSBuild", - "ah": "OSBuild", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "OSDistribution", - "ah": "OSDistribution", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSPlatform", - "ah": "OSPlatform", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSVersion", - "ah": "OSVersion", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSVersionInfo", - "ah": "OSVersionInfo", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OnboardingStatus", - "ah": "OnboardingStatus", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OsBuildRevision", - "ah": "OsBuildRevision", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "PublicIP", - "ah": "PublicIP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RegistryDeviceTag", - "ah": "RegistryDeviceTag", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "RestrictedDeviceSecurityOperations", - "ah": "RestrictedDeviceSecurityOperations", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SensorHealthState", - "ah": "SensorHealthState", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Vendor", - "ah": "Vendor", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [ - "ConnectivityType", - "DiscoverySources", - "DlpInfo", - "FirmwareVersions", - "Site" - ] - }, - { - "sentinelTable": "DeviceLogonEvents", - "ahTable": "DeviceLogonEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 51, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceNetworkEvents", - "ahTable": "DeviceNetworkEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 47, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceNetworkInfo", - "ahTable": "DeviceNetworkInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 18, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceProcessEvents", - "ahTable": "DeviceProcessEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 70, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceRegistryEvents", - "ahTable": "DeviceRegistryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 45, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/0/content/query", - "sourceSha256": "cb071c1659672fa84632cfaacb3165d49765a22282541afece8c51bba08f4b54", - "targetSha256": "cb071c1659672fa84632cfaacb3165d49765a22282541afece8c51bba08f4b54" - }, - { - "sourcePath": "/items/4/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "eca4ca05cd64deeb3cc30440c5025651b0634c6772a2f25dfc040a66dbdb0c59" - }, - "conversion": { - "sourceId": "/items/4/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let AllDeviceNames = DeviceInfo | distinct DeviceId, DeviceName;\nlet DeviceEventSummary = DeviceEvents | extend Type = \"DeviceEvents\" | summarize count() by DeviceId, Type, bin(TimeGenerated,1d);\nlet DeviceNetworkEventsSummary = DeviceNetworkEvents | extend Type = \"DeviceNetworkEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceNetworkInfoSummary = DeviceNetworkInfo | extend Type = \"DeviceNetworkInfo\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceLogonEventsSummary = DeviceLogonEvents | extend Type = \"DeviceLogonEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceRegistryEventsSummary = DeviceRegistryEvents | extend Type = \"DeviceRegistryEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\nlet DeviceProcessEventsSummary = DeviceProcessEvents | extend Type = \"DeviceProcessEvents\" | summarize count() by DeviceId,Type, bin(TimeGenerated,1d);\n(DeviceEventSummary\n| union DeviceNetworkEventsSummary,\nDeviceNetworkEventsSummary,\nDeviceNetworkInfoSummary,\nDeviceLogonEventsSummary,\nDeviceRegistryEventsSummary,\nDeviceProcessEventsSummary)\n| join kind=inner ( \nAllDeviceNames\n)\non $left.DeviceId == $right.DeviceId\n| project-reorder Type, TimeGenerated, count_\n//| project-away DeviceId, DeviceId1", - "resolvedTables": [ - "DeviceEvents", - "DeviceInfo", - "DeviceLogonEvents", - "DeviceNetworkEvents", - "DeviceNetworkInfo", - "DeviceProcessEvents", - "DeviceRegistryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [ - { - "kind": "synthesize-type-column", - "before": "Type", - "after": "Type = \"DeviceEvents\"", - "count": 1, - "source": "deterministic", - "reason": "Preserve a direct table summarize grouping with its native table label" - }, - { - "kind": "synthesize-type-column", - "before": "Type", - "after": "Type = \"DeviceNetworkEvents\"", - "count": 1, - "source": "deterministic", - "reason": "Preserve a direct table summarize grouping with its native table label" - }, - { - "kind": "synthesize-type-column", - "before": "Type", - "after": "Type = \"DeviceNetworkInfo\"", - "count": 1, - "source": "deterministic", - "reason": "Preserve a direct table summarize grouping with its native table label" - }, - { - "kind": "synthesize-type-column", - "before": "Type", - "after": "Type = \"DeviceLogonEvents\"", - "count": 1, - "source": "deterministic", - "reason": "Preserve a direct table summarize grouping with its native table label" - }, - { - "kind": "synthesize-type-column", - "before": "Type", - "after": "Type = \"DeviceRegistryEvents\"", - "count": 1, - "source": "deterministic", - "reason": "Preserve a direct table summarize grouping with its native table label" - }, - { - "kind": "synthesize-type-column", - "before": "Type", - "after": "Type = \"DeviceProcessEvents\"", - "count": 1, - "source": "deterministic", - "reason": "Preserve a direct table summarize grouping with its native table label" - } - ], - "schemaMap": [ - { - "sentinelTable": "DeviceEvents", - "ahTable": "DeviceEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 67, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceInfo", - "ahTable": "DeviceInfo", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AadDeviceId", - "ah": "AadDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AssetValue", - "ah": "AssetValue", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AwsResourceName", - "ah": "AwsResourceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureResourceId", - "ah": "AzureResourceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureVmId", - "ah": "AzureVmId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureVmSubscriptionId", - "ah": "AzureVmSubscriptionId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ClientVersion", - "ah": "ClientVersion", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "CloudPlatforms", - "ah": "CloudPlatforms", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceCategory", - "ah": "DeviceCategory", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceDynamicTags", - "ah": "DeviceDynamicTags", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceId", - "ah": "DeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceManualTags", - "ah": "DeviceManualTags", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceObjectId", - "laType": "string", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "DeviceSubtype", - "ah": "DeviceSubtype", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceType", - "ah": "DeviceType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ExclusionReason", - "ah": "ExclusionReason", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ExposureLevel", - "ah": "ExposureLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "GcpFullResourceName", - "ah": "GcpFullResourceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "HardwareUuid", - "ah": "HardwareUuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "HostDeviceId", - "ah": "HostDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsAzureADJoined", - "ah": "IsAzureADJoined", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsExcluded", - "ah": "IsExcluded", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsInternetFacing", - "ah": "IsInternetFacing", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsTransient", - "ah": "IsTransient", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "JoinType", - "ah": "JoinType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LoggedOnUsers", - "ah": "LoggedOnUsers", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "MachineGroup", - "ah": "MachineGroup", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MergedDeviceIds", - "ah": "MergedDeviceIds", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MergedToDeviceId", - "ah": "MergedToDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MitigationStatus", - "ah": "MitigationStatus", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Model", - "ah": "Model", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSArchitecture", - "ah": "OSArchitecture", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSBuild", - "ah": "OSBuild", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "OSDistribution", - "ah": "OSDistribution", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSPlatform", - "ah": "OSPlatform", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSVersion", - "ah": "OSVersion", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSVersionInfo", - "ah": "OSVersionInfo", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OnboardingStatus", - "ah": "OnboardingStatus", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OsBuildRevision", - "ah": "OsBuildRevision", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "PublicIP", - "ah": "PublicIP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RegistryDeviceTag", - "ah": "RegistryDeviceTag", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "RestrictedDeviceSecurityOperations", - "ah": "RestrictedDeviceSecurityOperations", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SensorHealthState", - "ah": "SensorHealthState", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Vendor", - "ah": "Vendor", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [ - "ConnectivityType", - "DiscoverySources", - "DlpInfo", - "FirmwareVersions", - "Site" - ] - }, - { - "sentinelTable": "DeviceLogonEvents", - "ahTable": "DeviceLogonEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 51, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceNetworkEvents", - "ahTable": "DeviceNetworkEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 47, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceNetworkInfo", - "ahTable": "DeviceNetworkInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 18, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceProcessEvents", - "ahTable": "DeviceProcessEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 70, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceRegistryEvents", - "ahTable": "DeviceRegistryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 45, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/1/content/query", - "sourceSha256": "eca4ca05cd64deeb3cc30440c5025651b0634c6772a2f25dfc040a66dbdb0c59", - "targetSha256": "50094cc183cf03326fb949dc42895a44a6520bd5f4b7b6db4711c4962a66fcdc" - }, - { - "sourcePath": "/items/4/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "dec86c7d5ffe294904662836a11ecc397064af1d9a9199ad42876901a2eab07d" - }, - "conversion": { - "sourceId": "/items/4/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "DeviceInfo \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| extend ParsedFields=parse_json(LoggedOnUsers)[0]\r\n| extend DurationAtLeast= format_timespan(now()-TimeGenerated,'dd:hh:mm:ss')\r\n| project DurationAtLeast,TimeGenerated,DeviceName,DomainName=ParsedFields.DomainName,UserName=ParsedFields.UserName\r\n| order by DurationAtLeast asc", - "resolvedTables": [ - "DeviceInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceInfo", - "ahTable": "DeviceInfo", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AadDeviceId", - "ah": "AadDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AssetValue", - "ah": "AssetValue", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AwsResourceName", - "ah": "AwsResourceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureResourceId", - "ah": "AzureResourceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureVmId", - "ah": "AzureVmId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureVmSubscriptionId", - "ah": "AzureVmSubscriptionId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ClientVersion", - "ah": "ClientVersion", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "CloudPlatforms", - "ah": "CloudPlatforms", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceCategory", - "ah": "DeviceCategory", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceDynamicTags", - "ah": "DeviceDynamicTags", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceId", - "ah": "DeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceManualTags", - "ah": "DeviceManualTags", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceObjectId", - "laType": "string", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "DeviceSubtype", - "ah": "DeviceSubtype", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceType", - "ah": "DeviceType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ExclusionReason", - "ah": "ExclusionReason", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ExposureLevel", - "ah": "ExposureLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "GcpFullResourceName", - "ah": "GcpFullResourceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "HardwareUuid", - "ah": "HardwareUuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "HostDeviceId", - "ah": "HostDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsAzureADJoined", - "ah": "IsAzureADJoined", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsExcluded", - "ah": "IsExcluded", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsInternetFacing", - "ah": "IsInternetFacing", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsTransient", - "ah": "IsTransient", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "JoinType", - "ah": "JoinType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LoggedOnUsers", - "ah": "LoggedOnUsers", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "MachineGroup", - "ah": "MachineGroup", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MergedDeviceIds", - "ah": "MergedDeviceIds", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MergedToDeviceId", - "ah": "MergedToDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MitigationStatus", - "ah": "MitigationStatus", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Model", - "ah": "Model", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSArchitecture", - "ah": "OSArchitecture", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSBuild", - "ah": "OSBuild", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "OSDistribution", - "ah": "OSDistribution", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSPlatform", - "ah": "OSPlatform", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSVersion", - "ah": "OSVersion", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSVersionInfo", - "ah": "OSVersionInfo", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OnboardingStatus", - "ah": "OnboardingStatus", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OsBuildRevision", - "ah": "OsBuildRevision", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "PublicIP", - "ah": "PublicIP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RegistryDeviceTag", - "ah": "RegistryDeviceTag", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "RestrictedDeviceSecurityOperations", - "ah": "RestrictedDeviceSecurityOperations", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SensorHealthState", - "ah": "SensorHealthState", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Vendor", - "ah": "Vendor", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [ - "ConnectivityType", - "DiscoverySources", - "DlpInfo", - "FirmwareVersions", - "Site" - ] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/2/content/query", - "sourceSha256": "dec86c7d5ffe294904662836a11ecc397064af1d9a9199ad42876901a2eab07d", - "targetSha256": "dec86c7d5ffe294904662836a11ecc397064af1d9a9199ad42876901a2eab07d" - }, - { - "sourcePath": "/items/4/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "cba61d36521eb072066130d1cbab27278c9861ed65d909e2a9c502181e38a901" - }, - "conversion": { - "sourceId": "/items/4/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let UsbDriveMount = DeviceEvents\r\n| where ActionType==\"UsbDriveMounted\"\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\r\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\r\n| order by DeviceId asc, MountTime desc;\r\nlet FileCreation = DeviceFileEvents\r\n| where InitiatingProcessAccountName != \"system\"\r\n| where ActionType == \"FileCreated\"\r\n| where FolderPath !startswith \"C:\\\\\"\r\n| where FolderPath !startswith \"\\\\\"\r\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\r\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\r\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\r\n| order by DeviceId asc, Timestamp desc;\r\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\r\n| where FolderPath startswith DriveLetter\r\n| where Timestamp >= MountTime\r\n| partition by ReportId ( top 1 by MountTime )\r\n| order by DeviceId asc, Timestamp desc\r\n| summarize FileCount = count() by DeviceName\r\n| order by FileCount desc", - "resolvedTables": [ - "DeviceEvents", - "DeviceFileEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceEvents", - "ahTable": "DeviceEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 67, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceFileEvents", - "ahTable": "DeviceFileEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 60, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/3/content/query", - "sourceSha256": "cba61d36521eb072066130d1cbab27278c9861ed65d909e2a9c502181e38a901", - "targetSha256": "cba61d36521eb072066130d1cbab27278c9861ed65d909e2a9c502181e38a901" - }, - { - "sourcePath": "/items/4/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "912cfbffa687f4226ddf118e66791f628a1592a4bd7627f19ce264cbe4ccde76" - }, - "conversion": { - "sourceId": "/items/4/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mvexpand ConnectedNetworks\r\n| summarize count() by tostring(ConnectedNetworks.IsConnectedToInternet)", - "resolvedTables": [ - "DeviceNetworkInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [ - { - "kind": "dynamic-cast", - "before": "ConnectedNetworks", - "after": "ConnectedNetworks = todynamic(tostring(ConnectedNetworks))", - "count": 1, - "source": "deterministic", - "reason": "`ConnectedNetworks` on `DeviceNetworkInfo` is delivered as a JSON string in Advanced Hunting; member access / mv-expand without a cast fails silently (0 rows, no bind error)." - } - ], - "schemaMap": [ - { - "sentinelTable": "DeviceNetworkInfo", - "ahTable": "DeviceNetworkInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 18, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/4/content/query", - "sourceSha256": "912cfbffa687f4226ddf118e66791f628a1592a4bd7627f19ce264cbe4ccde76", - "targetSha256": "f5fe20ba4db33ddaf9c052f9645f90125dbc1374705c2d21fbe91fc9df6b1666" - }, - { - "sourcePath": "/items/4/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "f03a1744e0f501490a81b97857c3aa74b69548ffe25982c7c77267dd005c03d1" - }, - "conversion": { - "sourceId": "/items/4/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(Timestamp, DeviceName) by DeviceId\r\n| extend DeviceMachineName = split(DeviceName, '.')[0]\r\n| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)\r\n| summarize count() by DeviceDomain", - "resolvedTables": [ - "DeviceInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceInfo", - "ahTable": "DeviceInfo", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AadDeviceId", - "ah": "AadDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AssetValue", - "ah": "AssetValue", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AwsResourceName", - "ah": "AwsResourceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureResourceId", - "ah": "AzureResourceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureVmId", - "ah": "AzureVmId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureVmSubscriptionId", - "ah": "AzureVmSubscriptionId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ClientVersion", - "ah": "ClientVersion", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "CloudPlatforms", - "ah": "CloudPlatforms", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceCategory", - "ah": "DeviceCategory", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceDynamicTags", - "ah": "DeviceDynamicTags", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceId", - "ah": "DeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceManualTags", - "ah": "DeviceManualTags", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceObjectId", - "laType": "string", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "DeviceSubtype", - "ah": "DeviceSubtype", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceType", - "ah": "DeviceType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ExclusionReason", - "ah": "ExclusionReason", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ExposureLevel", - "ah": "ExposureLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "GcpFullResourceName", - "ah": "GcpFullResourceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "HardwareUuid", - "ah": "HardwareUuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "HostDeviceId", - "ah": "HostDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsAzureADJoined", - "ah": "IsAzureADJoined", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsExcluded", - "ah": "IsExcluded", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsInternetFacing", - "ah": "IsInternetFacing", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsTransient", - "ah": "IsTransient", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "JoinType", - "ah": "JoinType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LoggedOnUsers", - "ah": "LoggedOnUsers", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "MachineGroup", - "ah": "MachineGroup", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MergedDeviceIds", - "ah": "MergedDeviceIds", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MergedToDeviceId", - "ah": "MergedToDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MitigationStatus", - "ah": "MitigationStatus", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Model", - "ah": "Model", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSArchitecture", - "ah": "OSArchitecture", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSBuild", - "ah": "OSBuild", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "OSDistribution", - "ah": "OSDistribution", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSPlatform", - "ah": "OSPlatform", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSVersion", - "ah": "OSVersion", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSVersionInfo", - "ah": "OSVersionInfo", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OnboardingStatus", - "ah": "OnboardingStatus", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OsBuildRevision", - "ah": "OsBuildRevision", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "PublicIP", - "ah": "PublicIP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RegistryDeviceTag", - "ah": "RegistryDeviceTag", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "RestrictedDeviceSecurityOperations", - "ah": "RestrictedDeviceSecurityOperations", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SensorHealthState", - "ah": "SensorHealthState", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Vendor", - "ah": "Vendor", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [ - "ConnectivityType", - "DiscoverySources", - "DlpInfo", - "FirmwareVersions", - "Site" - ] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/5/content/query", - "sourceSha256": "f03a1744e0f501490a81b97857c3aa74b69548ffe25982c7c77267dd005c03d1", - "targetSha256": "f03a1744e0f501490a81b97857c3aa74b69548ffe25982c7c77267dd005c03d1" - }, - { - "sourcePath": "/items/4/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "8a4120b5b6750a3b83db7afbe9a189cf46d4f62b4223e74b9e2b6dbe9494741d" - }, - "conversion": { - "sourceId": "/items/4/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by tostring(IsAzureADJoined)", - "resolvedTables": [ - "DeviceInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceInfo", - "ahTable": "DeviceInfo", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AadDeviceId", - "ah": "AadDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AssetValue", - "ah": "AssetValue", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AwsResourceName", - "ah": "AwsResourceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureResourceId", - "ah": "AzureResourceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureVmId", - "ah": "AzureVmId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureVmSubscriptionId", - "ah": "AzureVmSubscriptionId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ClientVersion", - "ah": "ClientVersion", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "CloudPlatforms", - "ah": "CloudPlatforms", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceCategory", - "ah": "DeviceCategory", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceDynamicTags", - "ah": "DeviceDynamicTags", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceId", - "ah": "DeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceManualTags", - "ah": "DeviceManualTags", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceObjectId", - "laType": "string", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "DeviceSubtype", - "ah": "DeviceSubtype", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceType", - "ah": "DeviceType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ExclusionReason", - "ah": "ExclusionReason", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ExposureLevel", - "ah": "ExposureLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "GcpFullResourceName", - "ah": "GcpFullResourceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "HardwareUuid", - "ah": "HardwareUuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "HostDeviceId", - "ah": "HostDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsAzureADJoined", - "ah": "IsAzureADJoined", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsExcluded", - "ah": "IsExcluded", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsInternetFacing", - "ah": "IsInternetFacing", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsTransient", - "ah": "IsTransient", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "JoinType", - "ah": "JoinType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LoggedOnUsers", - "ah": "LoggedOnUsers", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "MachineGroup", - "ah": "MachineGroup", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MergedDeviceIds", - "ah": "MergedDeviceIds", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MergedToDeviceId", - "ah": "MergedToDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MitigationStatus", - "ah": "MitigationStatus", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Model", - "ah": "Model", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSArchitecture", - "ah": "OSArchitecture", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSBuild", - "ah": "OSBuild", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "OSDistribution", - "ah": "OSDistribution", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSPlatform", - "ah": "OSPlatform", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSVersion", - "ah": "OSVersion", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSVersionInfo", - "ah": "OSVersionInfo", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OnboardingStatus", - "ah": "OnboardingStatus", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OsBuildRevision", - "ah": "OsBuildRevision", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "PublicIP", - "ah": "PublicIP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RegistryDeviceTag", - "ah": "RegistryDeviceTag", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "RestrictedDeviceSecurityOperations", - "ah": "RestrictedDeviceSecurityOperations", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SensorHealthState", - "ah": "SensorHealthState", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Vendor", - "ah": "Vendor", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [ - "ConnectivityType", - "DiscoverySources", - "DlpInfo", - "FirmwareVersions", - "Site" - ] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/6/content/query", - "sourceSha256": "8a4120b5b6750a3b83db7afbe9a189cf46d4f62b4223e74b9e2b6dbe9494741d", - "targetSha256": "8a4120b5b6750a3b83db7afbe9a189cf46d4f62b4223e74b9e2b6dbe9494741d" - }, - { - "sourcePath": "/items/4/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "7a37ccf7aa76480b785bdac593d936c36ed796379e4bf977c7b7dcf705e897e8" - }, - "conversion": { - "sourceId": "/items/4/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "DeviceInfo\r\n| where isnotempty(OSPlatform)\r\n| summarize arg_max(TimeGenerated, *) by DeviceId\r\n| summarize count() by ClientVersion", - "resolvedTables": [ - "DeviceInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceInfo", - "ahTable": "DeviceInfo", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AadDeviceId", - "ah": "AadDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AssetValue", - "ah": "AssetValue", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AwsResourceName", - "ah": "AwsResourceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureResourceId", - "ah": "AzureResourceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureVmId", - "ah": "AzureVmId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AzureVmSubscriptionId", - "ah": "AzureVmSubscriptionId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ClientVersion", - "ah": "ClientVersion", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "CloudPlatforms", - "ah": "CloudPlatforms", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceCategory", - "ah": "DeviceCategory", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceDynamicTags", - "ah": "DeviceDynamicTags", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceId", - "ah": "DeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceManualTags", - "ah": "DeviceManualTags", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceObjectId", - "laType": "string", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "DeviceSubtype", - "ah": "DeviceSubtype", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceType", - "ah": "DeviceType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ExclusionReason", - "ah": "ExclusionReason", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ExposureLevel", - "ah": "ExposureLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "GcpFullResourceName", - "ah": "GcpFullResourceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "HardwareUuid", - "ah": "HardwareUuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "HostDeviceId", - "ah": "HostDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsAzureADJoined", - "ah": "IsAzureADJoined", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsExcluded", - "ah": "IsExcluded", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsInternetFacing", - "ah": "IsInternetFacing", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "IsTransient", - "ah": "IsTransient", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "JoinType", - "ah": "JoinType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LoggedOnUsers", - "ah": "LoggedOnUsers", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "MachineGroup", - "ah": "MachineGroup", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MergedDeviceIds", - "ah": "MergedDeviceIds", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MergedToDeviceId", - "ah": "MergedToDeviceId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "MitigationStatus", - "ah": "MitigationStatus", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Model", - "ah": "Model", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSArchitecture", - "ah": "OSArchitecture", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSBuild", - "ah": "OSBuild", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "OSDistribution", - "ah": "OSDistribution", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSPlatform", - "ah": "OSPlatform", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSVersion", - "ah": "OSVersion", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSVersionInfo", - "ah": "OSVersionInfo", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OnboardingStatus", - "ah": "OnboardingStatus", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OsBuildRevision", - "ah": "OsBuildRevision", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "PublicIP", - "ah": "PublicIP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RegistryDeviceTag", - "ah": "RegistryDeviceTag", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "RestrictedDeviceSecurityOperations", - "ah": "RestrictedDeviceSecurityOperations", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SensorHealthState", - "ah": "SensorHealthState", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Vendor", - "ah": "Vendor", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [ - "ConnectivityType", - "DiscoverySources", - "DlpInfo", - "FirmwareVersions", - "Site" - ] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/7/content/query", - "sourceSha256": "7a37ccf7aa76480b785bdac593d936c36ed796379e4bf977c7b7dcf705e897e8", - "targetSha256": "7a37ccf7aa76480b785bdac593d936c36ed796379e4bf977c7b7dcf705e897e8" - }, - { - "sourcePath": "/items/5/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "6b320fcd4664c4fc0b85ff9b5228b9b2ef070cd26d61f7c926f40a1692bc91c1" - }, - "conversion": { - "sourceId": "/items/5/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query shows the source of the AV detections (e.g., the website the file was downloaded from etc.)\r\n//\r\n//Get the list of AV detections\r\nlet avDetections =\r\nDeviceEvents\r\n| where ActionType == \"AntivirusDetection\" and isnotempty(MD5)\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath, MD5;\r\n//Get a list of file creations\r\nlet fileCreations =\r\nDeviceFileEvents \r\n| where (isnotempty(FileOriginReferrerUrl) or isnotempty(FileOriginUrl)) and isnotempty(MD5)\r\n| project MD5, FileOriginUrl, FileOriginReferrerUrl, InitiatingProcessFileName, InitiatingProcessParentFileName;\r\n//Join the file creations and AV detections on the MD5 of the file\r\navDetections | join kind=inner (fileCreations) on MD5\r\n| project-away MD51 //Remove the duplicated MD5 field\r\n| sort by Timestamp desc ", - "resolvedTables": [ - "DeviceEvents", - "DeviceFileEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceEvents", - "ahTable": "DeviceEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 67, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceFileEvents", - "ahTable": "DeviceFileEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 60, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/0/content/query", - "sourceSha256": "6b320fcd4664c4fc0b85ff9b5228b9b2ef070cd26d61f7c926f40a1692bc91c1", - "targetSha256": "6b320fcd4664c4fc0b85ff9b5228b9b2ef070cd26d61f7c926f40a1692bc91c1" - }, - { - "sourcePath": "/items/5/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "54a5903992c02e06d5661fa8b75928719789d9bf7bd22d33703ddbecfaea6a5b" - }, - "conversion": { - "sourceId": "/items/5/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "DeviceEvents\r\n| where ActionType startswith \"Asr\" and ActionType endswith \"Audited\"\r\n// Count total stats - count events and machines per rule\r\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType", - "resolvedTables": [ - "DeviceEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceEvents", - "ahTable": "DeviceEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 67, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/1/content/query", - "sourceSha256": "54a5903992c02e06d5661fa8b75928719789d9bf7bd22d33703ddbecfaea6a5b", - "targetSha256": "54a5903992c02e06d5661fa8b75928719789d9bf7bd22d33703ddbecfaea6a5b" - }, - { - "sourcePath": "/items/5/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "e899e87ad3b910c7f0902b224d463322a896feacc37c4154f0f7acb5d6348fa2" - }, - "conversion": { - "sourceId": "/items/5/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "DeviceEvents\r\n| where ActionType startswith \"Asr\" and ActionType endswith \"Blocked\"\r\n// Count total stats - count events and machines per rule\r\n| summarize EventCount=count(), MachinesCount=dcount(DeviceId) by ActionType", - "resolvedTables": [ - "DeviceEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceEvents", - "ahTable": "DeviceEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 67, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/2/content/query", - "sourceSha256": "e899e87ad3b910c7f0902b224d463322a896feacc37c4154f0f7acb5d6348fa2", - "targetSha256": "e899e87ad3b910c7f0902b224d463322a896feacc37c4154f0f7acb5d6348fa2" - }, - { - "sourcePath": "/items/5/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "580fe67b33189f9c01eb8cb2bebf84e340292ab2b8a103996c6f02b3f717ba50" - }, - "conversion": { - "sourceId": "/items/5/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query make a best-guess detection regarding which removable media device caused an AV detection\r\n//The query is best run over 30 days to get the full USB history\r\n//\r\n//Get a list of USB AV detections. This assumes any path not beginning with C is a removable/USB device\r\nlet usbDetections =\r\n DeviceEvents\r\n | where ActionType == \"AntivirusDetection\" and FolderPath !startswith \"c\" and FolderPath matches regex \"^[A-Za-z]{1}\"\r\n | extend ParsedFields=parse_json(AdditionalFields)\r\n | project DetectionTime=Timestamp, DeviceName, ThreatName=tostring(ParsedFields.ThreatName), FileName, FolderPath;\r\n//Get a list of USB disk drive connections, grouped by computer name and DeviceID\r\nlet usbConnections = \r\n DeviceEvents\r\n | where ActionType == \"PnpDeviceConnected\"\r\n | extend parsed=parse_json(AdditionalFields)\r\n | project Timestamp, DeviceName, DeviceId=tostring(parsed.DeviceId), ClassName=tostring(parsed.ClassName)\r\n | where ClassName == \"DiskDrive\"\r\n | summarize UsbFirstSeen=min(Timestamp), UsbLastSeen=max(Timestamp) by DeviceId, DeviceName;\r\n//Join USB AV detections and connections, where the detection occurs after the USB has been plugged in\r\nusbDetections | join kind=inner (usbConnections) on DeviceName | where DetectionTime > UsbFirstSeen and DetectionTime < UsbLastSeen\r\n| project DetectionTime, DeviceName, ThreatName, FileName, FolderPath, DeviceId, UsbFirstSeen, UsbLastSeen\r\n| sort by DetectionTime desc", - "resolvedTables": [ - "DeviceEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceEvents", - "ahTable": "DeviceEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 67, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/3/content/query", - "sourceSha256": "580fe67b33189f9c01eb8cb2bebf84e340292ab2b8a103996c6f02b3f717ba50", - "targetSha256": "580fe67b33189f9c01eb8cb2bebf84e340292ab2b8a103996c6f02b3f717ba50" - }, - { - "sourcePath": "/items/5/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "8c15e02b4b3be1407b61906ddae6bb9d6429c336dbd0b5027b5a0c35ea44b62b" - }, - "conversion": { - "sourceId": "/items/5/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let UsbDriveMount = DeviceEvents\r\n| where ActionType==\"UsbDriveMounted\"\r\n| extend ParsedFields=parse_json(AdditionalFields)\r\n| project DeviceId, DeviceName, DriveLetter=ParsedFields.DriveLetter, MountTime=Timestamp,\r\nProductName=ParsedFields.ProductName,SerialNumber=ParsedFields.SerialNumber,Manufacturer=ParsedFields.Manufacturer\r\n| order by DeviceId asc, MountTime desc;\r\nlet FileCreation = DeviceFileEvents\r\n| where InitiatingProcessAccountName != \"system\"\r\n| where ActionType == \"FileCreated\"\r\n| where FolderPath !startswith \"C:\\\\\"\r\n| where FolderPath !startswith \"\\\\\"\r\n| project ReportId,DeviceId,InitiatingProcessAccountDomain,\r\nInitiatingProcessAccountName,InitiatingProcessAccountUpn,\r\nFileName, FolderPath, SHA256, Timestamp, SensitivityLabel, IsAzureInfoProtectionApplied\r\n| order by DeviceId asc, Timestamp desc;\r\nFileCreation | lookup kind=inner (UsbDriveMount) on DeviceId\r\n| where FolderPath startswith DriveLetter\r\n| where Timestamp >= MountTime\r\n| partition by ReportId ( top 1 by MountTime )\r\n| order by DeviceId asc, Timestamp desc", - "resolvedTables": [ - "DeviceEvents", - "DeviceFileEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceEvents", - "ahTable": "DeviceEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 67, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "DeviceFileEvents", - "ahTable": "DeviceFileEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 60, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/4/content/query", - "sourceSha256": "8c15e02b4b3be1407b61906ddae6bb9d6429c336dbd0b5027b5a0c35ea44b62b", - "targetSha256": "8c15e02b4b3be1407b61906ddae6bb9d6429c336dbd0b5027b5a0c35ea44b62b" - }, - { - "sourcePath": "/items/6/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "b2226a146819d8000285fa40a96140dffee3c7c1eb5e2b3077645a4faebc5edb" - }, - "conversion": { - "sourceId": "/items/6/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "DeviceNetworkInfo\r\n| extend ConnectedNetworks = todynamic(tostring(ConnectedNetworks)) \r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| mv-apply ConnectedNetworks on \r\n(\r\nwhere ConnectedNetworks.IsConnectedToInternet == true\r\n)\r\n| project DeviceName, DefaultGateways, IPv4Dhcp, IPv6Dhcp,MacAddress,MachineGroup, ConnectedNetworks.IsConnectedToInternet", - "resolvedTables": [ - "DeviceNetworkInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [ - { - "kind": "dynamic-cast", - "before": "ConnectedNetworks", - "after": "ConnectedNetworks = todynamic(tostring(ConnectedNetworks))", - "count": 1, - "source": "deterministic", - "reason": "`ConnectedNetworks` on `DeviceNetworkInfo` is delivered as a JSON string in Advanced Hunting; member access / mv-expand without a cast fails silently (0 rows, no bind error)." - } - ], - "schemaMap": [ - { - "sentinelTable": "DeviceNetworkInfo", - "ahTable": "DeviceNetworkInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 18, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/0/content/query", - "sourceSha256": "b2226a146819d8000285fa40a96140dffee3c7c1eb5e2b3077645a4faebc5edb", - "targetSha256": "3a5afcba5624d5c6401700184df39429dbd655db6c5a2a89ebd7f8b9eaa0d746" - }, - { - "sourcePath": "/items/6/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "555e81a53301f1436689be365393c0717603321a3a02713b352688cd6870a5a3" - }, - "conversion": { - "sourceId": "/items/6/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "DeviceNetworkInfo\r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| summarize count() by MachineGroup", - "resolvedTables": [ - "DeviceNetworkInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceNetworkInfo", - "ahTable": "DeviceNetworkInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 18, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/1/content/query", - "sourceSha256": "555e81a53301f1436689be365393c0717603321a3a02713b352688cd6870a5a3", - "targetSha256": "555e81a53301f1436689be365393c0717603321a3a02713b352688cd6870a5a3" - }, - { - "sourcePath": "/items/6/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "294004b280db138149291a40c8f2b78c1f74ba4f777c17615dd3bab7ff7ee1ea" - }, - "conversion": { - "sourceId": "/items/6/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "DeviceNetworkInfo\r\n| summarize arg_max(TimeGenerated,*) by DeviceId\r\n| summarize count() by NetworkAdapterType, NetworkAdapterStatus", - "resolvedTables": [ - "DeviceNetworkInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceNetworkInfo", - "ahTable": "DeviceNetworkInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 18, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/2/content/query", - "sourceSha256": "294004b280db138149291a40c8f2b78c1f74ba4f777c17615dd3bab7ff7ee1ea", - "targetSha256": "294004b280db138149291a40c8f2b78c1f74ba4f777c17615dd3bab7ff7ee1ea" - }, - { - "sourcePath": "/items/6/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "4ef3cca1b95083fc63a7cfb368e3643b91981f5872c0d95a3210368f25a90e52" - }, - "conversion": { - "sourceId": "/items/6/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "DeviceNetworkEvents\r\n| summarize count() by DeviceName, DeviceId,bin( TimeGenerated,5m)", - "resolvedTables": [ - "DeviceNetworkEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceNetworkEvents", - "ahTable": "DeviceNetworkEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 47, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/3/content/query", - "sourceSha256": "4ef3cca1b95083fc63a7cfb368e3643b91981f5872c0d95a3210368f25a90e52", - "targetSha256": "4ef3cca1b95083fc63a7cfb368e3643b91981f5872c0d95a3210368f25a90e52" - }, - { - "sourcePath": "/items/6/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "8dc392ae6633cd2ba0a9af11c23ff3a89577b60d158bd3088ab543673d6a8e0e" - }, - "conversion": { - "sourceId": "/items/6/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "DeviceNetworkEvents\r\n| where isnotempty(RemoteUrl)\r\n| summarize count() by RemoteUrl\r\n| order by count_ desc\r\n| limit 10", - "resolvedTables": [ - "DeviceNetworkEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceNetworkEvents", - "ahTable": "DeviceNetworkEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 47, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/4/content/query", - "sourceSha256": "8dc392ae6633cd2ba0a9af11c23ff3a89577b60d158bd3088ab543673d6a8e0e", - "targetSha256": "8dc392ae6633cd2ba0a9af11c23ff3a89577b60d158bd3088ab543673d6a8e0e" - }, - { - "sourcePath": "/items/6/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "16f00d253ed14ae4b7d545d8eee5ac6f5c1efe63d726dd2f252d67c444c8b801" - }, - "conversion": { - "sourceId": "/items/6/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// This query looks for Tor client, or for a common Tor plugin called Meek.\r\n// We query for active Tor connections, but could have alternatively looked for active Tor runs (ProcessCreateEvents) or Tor downloads (DeviceFileEvents)\r\n// To read more about this technique, see:\r\n// Tor: https://attack.mitre.org/wiki/Software/S0183#Techniques_Used\r\n// Meek plugin: https://attack.mitre.org/wiki/Software/S0175\r\n// Multi-hop proxy technique: https://attack.mitre.org/wiki/Technique/T1188\r\n// Tags: #Tor, #MultiHopProxy, #CnC\r\nDeviceNetworkEvents \r\n| where Timestamp < ago(3d) and InitiatingProcessFileName in~ (\"tor.exe\", \"meek-client.exe\")\r\n// Returns MD5 hashes of files used by Tor, to enable you to block them.\r\n// We count how prevalent each file is (by machines) and show examples for some of them (up to 5 machine names per hash).\r\n| summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessMD5\r\n| order by MachineCount desc", - "resolvedTables": [ - "DeviceNetworkEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceNetworkEvents", - "ahTable": "DeviceNetworkEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 47, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/5/content/query", - "sourceSha256": "16f00d253ed14ae4b7d545d8eee5ac6f5c1efe63d726dd2f252d67c444c8b801", - "targetSha256": "16f00d253ed14ae4b7d545d8eee5ac6f5c1efe63d726dd2f252d67c444c8b801" - }, - { - "sourcePath": "/items/7/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "ca8c7d543e78b0b3c17cf5f2cd4e3d459290279886383482e7e154b5baa63e69" - }, - "conversion": { - "sourceId": "/items/7/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "DeviceFileEvents\r\n| summarize FileActivityCount = count() by DeviceName", - "resolvedTables": [ - "DeviceFileEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceFileEvents", - "ahTable": "DeviceFileEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 60, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/0/content/query", - "sourceSha256": "ca8c7d543e78b0b3c17cf5f2cd4e3d459290279886383482e7e154b5baa63e69", - "targetSha256": "ca8c7d543e78b0b3c17cf5f2cd4e3d459290279886383482e7e154b5baa63e69" - }, - { - "sourcePath": "/items/7/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "0eb0f818ef22a8c48bd3b16196cbab8d64a694c7a4f96632ef9b69ecdd96afd7" - }, - "conversion": { - "sourceId": "/items/7/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "DeviceFileEvents\r\n| summarize count() by InitiatingProcessAccountUpn", - "resolvedTables": [ - "DeviceFileEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "DeviceFileEvents", - "ahTable": "DeviceFileEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 60, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/1/content/query", - "sourceSha256": "0eb0f818ef22a8c48bd3b16196cbab8d64a694c7a4f96632ef9b69ecdd96afd7", - "targetSha256": "0eb0f818ef22a8c48bd3b16196cbab8d64a694c7a4f96632ef9b69ecdd96afd7" - } - ] - }, + "format": "public-workbook-v1", + "origin": "sentinel-migration", "requiredWorkloads": [ { "workload": "mde", @@ -3884,6 +595,6 @@ } ], "requiredDataConnectors": [], - "dependencyReviewRequired": false + "requiredWorkspaceFunctions": [] } } diff --git a/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForIdentity.json b/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForIdentity.json index e197b366ef1..b50c6ff9b11 100644 --- a/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForIdentity.json +++ b/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForIdentity.json @@ -218,7 +218,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityLogonEvents\r\n| summarize count() by Protocol", + "query": "IdentityLogonEvents\r\n| summarize count() by Protocol = coalesce(Protocol, \"Unknown\")", "size": 0, "title": "Log On Protocol", "timeContextFromParameter": "TimeRange", @@ -246,9 +246,10 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityQueryEvents\r\n| summarize count() by DestinationPort", + "query": "IdentityQueryEvents\r\n| summarize count() by DestinationPort = coalesce(tostring(DestinationPort), \"Unknown\")", "size": 0, "title": "Query Destination Port", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart" }, @@ -283,7 +284,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityDirectoryEvents\r\n| summarize count() by Protocol", + "query": "IdentityDirectoryEvents\r\n| summarize count() by Protocol = coalesce(Protocol, \"Unknown\")", "size": 0, "title": "Directory Events Protocol", "timeContextFromParameter": "TimeRange", @@ -297,9 +298,9 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityDirectoryEvents\r\n| summarize count() by AccountDomain", + "query": "IdentityDirectoryEvents\r\n| summarize count() by AccountDomain = coalesce(AccountDomain, \"Unknown\")", "size": 0, - "title": "Directory Events Protocol", + "title": "Directory Events Account Domain", "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart" @@ -311,9 +312,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityDirectoryEvents\r\n| where isnotempty(AccountUpn)\r\n| summarize count() by AccountUpn\r\n| order by count_ desc \r\n| take 10", + "query": "IdentityDirectoryEvents\r\n| extend Account = coalesce(AccountUpn, iff(isnotempty(AccountName) and isnotempty(AccountDomain), strcat(AccountDomain, \"\\\\\", AccountName), AccountName), tostring(AdditionalFields[\"ACTOR.ACCOUNT\"]), AccountSid)\r\n| where isnotempty(Account)\r\n| summarize count() by Account\r\n| order by count_ desc \r\n| take 10", "size": 0, "title": "Top 10 Accounts Activity", + "subtitle": "Account UPN, domain/name, actor account, or SID, in that order.", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "table", "gridSettings": { @@ -386,6 +389,7 @@ "query": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Resource access\"\r\n| extend TargetComputerOperatingSystem_ = tostring(AdditionalFields.TargetComputerOperatingSystem)\r\n| extend DestinationComputerOperatingSystem_ = tostring(AdditionalFields.DestinationComputerOperatingSystem)\r\n| extend Count_ = toint(AdditionalFields.Count)\r\n| summarize sum(Count_) by TargetComputerOperatingSystem_, DestinationComputerOperatingSystem_\r\n| order by sum_Count_ desc", "size": 0, "title": "Resource Access Summary in OS", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { "formatters": [ @@ -416,6 +420,7 @@ "query": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Credentials validation\"\r\n| extend FROM_DEVICE = tostring(AdditionalFields.[\"FROM.DEVICE\"])\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize sum(Count) by FROM_DEVICE, TO_DEVICE\r\n| order by sum_Count desc", "size": 0, "title": "Credentials validation Summary in Devices", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { "formatters": [ @@ -489,7 +494,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let data = IdentityLogonEvents;\r\ndata\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize LogonSuccess = sumif(Count,ActionType == \"LogonSuccess\"),LogonFailed= sumif(Count,ActionType == \"LogonFailed\") by AccountUpn\r\n| join kind = inner\r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\r\n) on $left.AccountUpn == $right.AccountUpn", + "query": "let data = IdentityLogonEvents\r\n| extend Count = coalesce(toint(AdditionalFields.Count), 1);\r\ndata\r\n| summarize LogonSuccess = sumif(Count,ActionType == \"LogonSuccess\"),LogonFailed= sumif(Count,ActionType == \"LogonFailed\") by AccountUpn\r\n| join kind = inner\r\n(\r\ndata\r\n| make-series Trend = sum(Count) default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\r\n) on $left.AccountUpn == $right.AccountUpn", "size": 0, "title": "Logon Summary by Users", "timeContextFromParameter": "TimeRange", @@ -609,6 +614,7 @@ "query": "let data = IdentityQueryEvents;\r\ndata\r\n| summarize count() by DeviceName\r\n| join kind =inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceName\r\n) on $left.DeviceName == $right.DeviceName", "size": 0, "title": "Query Summary from Source Devices", + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { "formatters": [ @@ -666,7 +672,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityDirectoryEvents\r\n| summarize count() by ActionType \r\n| order by count_ desc", + "query": "IdentityDirectoryEvents\r\n| summarize count() by ActionType \r\n| order by count_ desc\r\n| take 10", "size": 0, "title": "Top 10 Actions", "timeContextFromParameter": "TimeRange", @@ -715,9 +721,10 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "IdentityDirectoryEvents\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn", + "query": "IdentityDirectoryEvents\r\n| extend Account = coalesce(AccountUpn, iff(isnotempty(AccountName) and isnotempty(AccountDomain), strcat(AccountDomain, \"\\\\\", AccountName), AccountName), tostring(AdditionalFields[\"ACTOR.ACCOUNT\"]), AccountSid)\r\n| where isnotempty(Account)\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Account", "size": 0, "title": "Account Trend on Directory Events", + "subtitle": "Account UPN, domain/name, actor account, or SID, in that order.", "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "table", @@ -783,7 +790,8 @@ "version": "KqlItem/1.0", "query": "let data = SecurityAlert\r\n| where ProductName == \"Azure Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated,*) by SystemAlertId;\r\ndata\r\n| summarize count() by AlertName\r\n| join kind=inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AlertName\r\n) on AlertName", "size": 0, - "noDataMessage": "Alerts", + "title": "Alerts", + "noDataMessage": "No identity alerts found in the selected time range.", "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "gridSettings": { @@ -868,4552 +876,13 @@ "xdrMetadata": { "contentId": "200c5dd2-9786-5619-8425-4508a238d76a", "instanceId": "baa399d3-2174-5938-b0b8-b91aed73090a", - "version": "3.2.1", + "version": "3.2.2", "schemaVersion": "1.0.0", - "displayName": "MicrosoftDefenderForIdentity" + "displayName": "Microsoft Defender For Identity" }, "contentProvenance": { - "source": { - "path": "Workbooks/MicrosoftDefenderForIdentity.json", - "sha256": "45a02cbd2d0a3a4e0afb535dc2611623bb4da4ebc855a97aadc5012dfcba5068", - "contentId": "sentinel-MicrosoftDefenderForIdentity", - "originalMetadataVersion": null - }, - "conversion": { - "tool": "sentinel-xdr-migration", - "version": "0.1.0", - "reviewRequired": false, - "queries": [ - { - "sourcePath": "/items/1/content/parameters/1/query", - "status": "removed-scope-helper", - "outputPath": null, - "sourceSha256": "49d6e69eb90170912b1e70a4d8c01d3f19d11b10c46b8a72ba0fda4cfc4a6257", - "targetSha256": null - }, - { - "sourcePath": "/items/4/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "55a24358602dc66ce19b7782a2471bb4683aaf0ba29be08d45b6bb880ff431c5" - }, - "conversion": { - "sourceId": "/items/4/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "IdentityLogonEvents\r\n| summarize count() by LogonType", - "resolvedTables": [ - "IdentityLogonEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "IdentityLogonEvents", - "ahTable": "IdentityLogonEvents", - "identical": false, - "verdict": "Review", - "score": 0.966, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceType", - "ah": "DeviceType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "FailureReason", - "ah": "FailureReason", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ISP", - "ah": "ISP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LastSeenForUser", - "ah": "LastSeenForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LogonType", - "ah": "LogonType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSPlatform", - "ah": "OSPlatform", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "UncommonForUser", - "ah": "UncommonForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/0/content/query", - "sourceSha256": "55a24358602dc66ce19b7782a2471bb4683aaf0ba29be08d45b6bb880ff431c5", - "targetSha256": "55a24358602dc66ce19b7782a2471bb4683aaf0ba29be08d45b6bb880ff431c5" - }, - { - "sourcePath": "/items/4/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "067b2c84ac76d39cb98d782766a2333ad321ddacc62067c5df38887181e45e4d" - }, - "conversion": { - "sourceId": "/items/4/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "IdentityLogonEvents\r\n|summarize count() by ActionType", - "resolvedTables": [ - "IdentityLogonEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "IdentityLogonEvents", - "ahTable": "IdentityLogonEvents", - "identical": false, - "verdict": "Review", - "score": 0.966, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceType", - "ah": "DeviceType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "FailureReason", - "ah": "FailureReason", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ISP", - "ah": "ISP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LastSeenForUser", - "ah": "LastSeenForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LogonType", - "ah": "LogonType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSPlatform", - "ah": "OSPlatform", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "UncommonForUser", - "ah": "UncommonForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/1/content/query", - "sourceSha256": "067b2c84ac76d39cb98d782766a2333ad321ddacc62067c5df38887181e45e4d", - "targetSha256": "067b2c84ac76d39cb98d782766a2333ad321ddacc62067c5df38887181e45e4d" - }, - { - "sourcePath": "/items/4/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "7c73b3f858780b841d5fba68530dbbb26f27d300f7361a9a061778d92fb9c233" - }, - "conversion": { - "sourceId": "/items/4/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "IdentityLogonEvents\r\n| summarize count() by Protocol", - "resolvedTables": [ - "IdentityLogonEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "IdentityLogonEvents", - "ahTable": "IdentityLogonEvents", - "identical": false, - "verdict": "Review", - "score": 0.966, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceType", - "ah": "DeviceType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "FailureReason", - "ah": "FailureReason", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ISP", - "ah": "ISP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LastSeenForUser", - "ah": "LastSeenForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LogonType", - "ah": "LogonType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSPlatform", - "ah": "OSPlatform", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "UncommonForUser", - "ah": "UncommonForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/2/content/query", - "sourceSha256": "7c73b3f858780b841d5fba68530dbbb26f27d300f7361a9a061778d92fb9c233", - "targetSha256": "7c73b3f858780b841d5fba68530dbbb26f27d300f7361a9a061778d92fb9c233" - }, - { - "sourcePath": "/items/4/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "1befee06de450f1c956c230d76282dfcd8bcc7ad5aeee4572ee7be4e00e6b446" - }, - "conversion": { - "sourceId": "/items/4/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "IdentityQueryEvents\r\n| summarize count() by Protocol", - "resolvedTables": [ - "IdentityQueryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "IdentityQueryEvents", - "ahTable": "IdentityQueryEvents", - "identical": false, - "verdict": "Review", - "score": 0.962, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Query", - "ah": "Query", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "QueryTarget", - "ah": "QueryTarget", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "QueryType", - "ah": "QueryType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountUpn", - "ah": "TargetAccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/3/content/query", - "sourceSha256": "1befee06de450f1c956c230d76282dfcd8bcc7ad5aeee4572ee7be4e00e6b446", - "targetSha256": "1befee06de450f1c956c230d76282dfcd8bcc7ad5aeee4572ee7be4e00e6b446" - }, - { - "sourcePath": "/items/4/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "9b7fb90da715b52749eacc4717c0c990df3c4e0e0f2ad5b4fac65ad03d11c060" - }, - "conversion": { - "sourceId": "/items/4/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "IdentityQueryEvents\r\n| summarize count() by DestinationPort", - "resolvedTables": [ - "IdentityQueryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "IdentityQueryEvents", - "ahTable": "IdentityQueryEvents", - "identical": false, - "verdict": "Review", - "score": 0.962, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Query", - "ah": "Query", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "QueryTarget", - "ah": "QueryTarget", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "QueryType", - "ah": "QueryType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountUpn", - "ah": "TargetAccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/4/content/query", - "sourceSha256": "9b7fb90da715b52749eacc4717c0c990df3c4e0e0f2ad5b4fac65ad03d11c060", - "targetSha256": "9b7fb90da715b52749eacc4717c0c990df3c4e0e0f2ad5b4fac65ad03d11c060" - }, - { - "sourcePath": "/items/4/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "0bf43ca58f71de576ba70f30204105613730ef6cd702cc81907a2c1e6b5cd59a" - }, - "conversion": { - "sourceId": "/items/4/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "IdentityQueryEvents\r\n| where isnotempty(QueryType)\r\n| summarize count() by QueryType\r\n| order by count_ desc\r\n| take 10", - "resolvedTables": [ - "IdentityQueryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "IdentityQueryEvents", - "ahTable": "IdentityQueryEvents", - "identical": false, - "verdict": "Review", - "score": 0.962, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Query", - "ah": "Query", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "QueryTarget", - "ah": "QueryTarget", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "QueryType", - "ah": "QueryType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountUpn", - "ah": "TargetAccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/5/content/query", - "sourceSha256": "0bf43ca58f71de576ba70f30204105613730ef6cd702cc81907a2c1e6b5cd59a", - "targetSha256": "0bf43ca58f71de576ba70f30204105613730ef6cd702cc81907a2c1e6b5cd59a" - }, - { - "sourcePath": "/items/4/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "da0561e7b7b85a5ffc136ef633eaf6f028048926a86d01dfcdccc6891e1000df" - }, - "conversion": { - "sourceId": "/items/4/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "IdentityDirectoryEvents\r\n| summarize count() by Protocol", - "resolvedTables": [ - "IdentityDirectoryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "IdentityDirectoryEvents", - "ahTable": "IdentityDirectoryEvents", - "identical": false, - "verdict": "Review", - "score": 0.958, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ISP", - "ah": "ISP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountUpn", - "ah": "TargetAccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/6/content/query", - "sourceSha256": "da0561e7b7b85a5ffc136ef633eaf6f028048926a86d01dfcdccc6891e1000df", - "targetSha256": "da0561e7b7b85a5ffc136ef633eaf6f028048926a86d01dfcdccc6891e1000df" - }, - { - "sourcePath": "/items/4/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "48f1ecdc776d5c0bdfcd89c5a335be3400a2c18039c376121e09e25d4910f77e" - }, - "conversion": { - "sourceId": "/items/4/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "IdentityDirectoryEvents\r\n| summarize count() by AccountDomain", - "resolvedTables": [ - "IdentityDirectoryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "IdentityDirectoryEvents", - "ahTable": "IdentityDirectoryEvents", - "identical": false, - "verdict": "Review", - "score": 0.958, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ISP", - "ah": "ISP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountUpn", - "ah": "TargetAccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/7/content/query", - "sourceSha256": "48f1ecdc776d5c0bdfcd89c5a335be3400a2c18039c376121e09e25d4910f77e", - "targetSha256": "48f1ecdc776d5c0bdfcd89c5a335be3400a2c18039c376121e09e25d4910f77e" - }, - { - "sourcePath": "/items/4/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "039424d4269139394a41c8dcbe93cb5fa865c0e3e89d43d42fb643efd99e9204" - }, - "conversion": { - "sourceId": "/items/4/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "IdentityDirectoryEvents\r\n| where isnotempty(AccountUpn)\r\n| summarize count() by AccountUpn\r\n| order by count_ desc \r\n| take 10", - "resolvedTables": [ - "IdentityDirectoryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "IdentityDirectoryEvents", - "ahTable": "IdentityDirectoryEvents", - "identical": false, - "verdict": "Review", - "score": 0.958, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ISP", - "ah": "ISP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountUpn", - "ah": "TargetAccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/4/content/items/8/content/query", - "sourceSha256": "039424d4269139394a41c8dcbe93cb5fa865c0e3e89d43d42fb643efd99e9204", - "targetSha256": "039424d4269139394a41c8dcbe93cb5fa865c0e3e89d43d42fb643efd99e9204" - }, - { - "sourcePath": "/items/5/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "0e4caaa2fa2339e0e70034afd7cddf1bd4e0761cc6a7b97a83f451d19f2c61d9" - }, - "conversion": { - "sourceId": "/items/5/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Resource access\"\r\n| extend FROM_DEVICE_ = tostring(AdditionalFields.[\"FROM.DEVICE\"])\r\n| extend TO_DEVICE_ = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count_ = toint(AdditionalFields.Count)\r\n| summarize sum(Count_) by FROM_DEVICE_, TO_DEVICE_\r\n| order by sum_Count_ desc", - "resolvedTables": [ - "IdentityLogonEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [ - { - "kind": "dynamic-cast", - "before": "AdditionalFields", - "after": "AdditionalFields = todynamic(tostring(AdditionalFields))", - "count": 1, - "source": "deterministic", - "reason": "`AdditionalFields` on `IdentityLogonEvents` is delivered as a JSON string in Advanced Hunting; member access / mv-expand without a cast fails silently (0 rows, no bind error)." - } - ], - "schemaMap": [ - { - "sentinelTable": "IdentityLogonEvents", - "ahTable": "IdentityLogonEvents", - "identical": false, - "verdict": "Review", - "score": 0.966, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceType", - "ah": "DeviceType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "FailureReason", - "ah": "FailureReason", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ISP", - "ah": "ISP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LastSeenForUser", - "ah": "LastSeenForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LogonType", - "ah": "LogonType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSPlatform", - "ah": "OSPlatform", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "UncommonForUser", - "ah": "UncommonForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/0/content/query", - "sourceSha256": "0e4caaa2fa2339e0e70034afd7cddf1bd4e0761cc6a7b97a83f451d19f2c61d9", - "targetSha256": "c38504885307007f07519caf94ce7aaa1441dacd4846f25ca0560e8f74294922" - }, - { - "sourcePath": "/items/5/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "cf5dfc7f0546da39e3160c42cb08180cf9895010fc87e20605c6cab1fb41b8ba" - }, - "conversion": { - "sourceId": "/items/5/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Resource access\"\r\n| extend TargetComputerOperatingSystem_ = tostring(AdditionalFields.TargetComputerOperatingSystem)\r\n| extend DestinationComputerOperatingSystem_ = tostring(AdditionalFields.DestinationComputerOperatingSystem)\r\n| extend Count_ = toint(AdditionalFields.Count)\r\n| summarize sum(Count_) by TargetComputerOperatingSystem_, DestinationComputerOperatingSystem_\r\n| order by sum_Count_ desc", - "resolvedTables": [ - "IdentityLogonEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [ - { - "kind": "dynamic-cast", - "before": "AdditionalFields", - "after": "AdditionalFields = todynamic(tostring(AdditionalFields))", - "count": 1, - "source": "deterministic", - "reason": "`AdditionalFields` on `IdentityLogonEvents` is delivered as a JSON string in Advanced Hunting; member access / mv-expand without a cast fails silently (0 rows, no bind error)." - } - ], - "schemaMap": [ - { - "sentinelTable": "IdentityLogonEvents", - "ahTable": "IdentityLogonEvents", - "identical": false, - "verdict": "Review", - "score": 0.966, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceType", - "ah": "DeviceType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "FailureReason", - "ah": "FailureReason", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ISP", - "ah": "ISP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LastSeenForUser", - "ah": "LastSeenForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LogonType", - "ah": "LogonType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSPlatform", - "ah": "OSPlatform", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "UncommonForUser", - "ah": "UncommonForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/1/content/query", - "sourceSha256": "cf5dfc7f0546da39e3160c42cb08180cf9895010fc87e20605c6cab1fb41b8ba", - "targetSha256": "722edffddc2c2ecdba4c445ee7bc3dcca7a45681dbae2a4e12d132ec818815cd" - }, - { - "sourcePath": "/items/5/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "face3925daef834748ae615b3b724b42fa01fd32f45cd635cd9bc34d21fdab66" - }, - "conversion": { - "sourceId": "/items/5/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Credentials validation\"\r\n| extend FROM_DEVICE = tostring(AdditionalFields.[\"FROM.DEVICE\"])\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize sum(Count) by FROM_DEVICE, TO_DEVICE\r\n| order by sum_Count desc", - "resolvedTables": [ - "IdentityLogonEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [ - { - "kind": "dynamic-cast", - "before": "AdditionalFields", - "after": "AdditionalFields = todynamic(tostring(AdditionalFields))", - "count": 1, - "source": "deterministic", - "reason": "`AdditionalFields` on `IdentityLogonEvents` is delivered as a JSON string in Advanced Hunting; member access / mv-expand without a cast fails silently (0 rows, no bind error)." - } - ], - "schemaMap": [ - { - "sentinelTable": "IdentityLogonEvents", - "ahTable": "IdentityLogonEvents", - "identical": false, - "verdict": "Review", - "score": 0.966, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceType", - "ah": "DeviceType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "FailureReason", - "ah": "FailureReason", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ISP", - "ah": "ISP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LastSeenForUser", - "ah": "LastSeenForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LogonType", - "ah": "LogonType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSPlatform", - "ah": "OSPlatform", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "UncommonForUser", - "ah": "UncommonForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/2/content/query", - "sourceSha256": "face3925daef834748ae615b3b724b42fa01fd32f45cd635cd9bc34d21fdab66", - "targetSha256": "731034da096ef9aa77e61b7b88398d990171271e063bde690c25485b7c9bd630" - }, - { - "sourcePath": "/items/5/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "4121acbd6129bcc13fcacd66f2b1dc1c2ffb5af9bc48a9993f35ca3184c2f992" - }, - "conversion": { - "sourceId": "/items/5/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let data = IdentityLogonEvents\r\n| extend AdditionalFields = todynamic(tostring(AdditionalFields)) \r\n| where LogonType == \"Credentials validation\"\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count = toint(AdditionalFields.Count);\r\ndata\r\n| summarize sum(Count) by TO_DEVICE\r\n| order by sum_Count desc\r\n| join kind=inner\r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by TO_DEVICE\r\n)\r\non $left.TO_DEVICE == $right.TO_DEVICE", - "resolvedTables": [ - "IdentityLogonEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [ - { - "kind": "dynamic-cast", - "before": "AdditionalFields", - "after": "AdditionalFields = todynamic(tostring(AdditionalFields))", - "count": 1, - "source": "deterministic", - "reason": "`AdditionalFields` on `IdentityLogonEvents` is delivered as a JSON string in Advanced Hunting; member access / mv-expand without a cast fails silently (0 rows, no bind error)." - } - ], - "schemaMap": [ - { - "sentinelTable": "IdentityLogonEvents", - "ahTable": "IdentityLogonEvents", - "identical": false, - "verdict": "Review", - "score": 0.966, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceType", - "ah": "DeviceType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "FailureReason", - "ah": "FailureReason", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ISP", - "ah": "ISP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LastSeenForUser", - "ah": "LastSeenForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LogonType", - "ah": "LogonType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSPlatform", - "ah": "OSPlatform", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "UncommonForUser", - "ah": "UncommonForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/3/content/query", - "sourceSha256": "4121acbd6129bcc13fcacd66f2b1dc1c2ffb5af9bc48a9993f35ca3184c2f992", - "targetSha256": "88594929c3dcf1ae71e28826629dc327f865b84d18b0cb0e109282efe00ce1e1" - }, - { - "sourcePath": "/items/5/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "5cfa1f00c5592101c3949fb5c9a4c844ca075b1967d5a978cf33e245e73f8570" - }, - "conversion": { - "sourceId": "/items/5/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let data = IdentityLogonEvents;\r\ndata\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize LogonSuccess = sumif(Count,ActionType == \"LogonSuccess\"),LogonFailed= sumif(Count,ActionType == \"LogonFailed\") by AccountUpn\r\n| join kind = inner\r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\r\n) on $left.AccountUpn == $right.AccountUpn", - "resolvedTables": [ - "IdentityLogonEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "IdentityLogonEvents", - "ahTable": "IdentityLogonEvents", - "identical": false, - "verdict": "Review", - "score": 0.966, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeviceType", - "ah": "DeviceType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "FailureReason", - "ah": "FailureReason", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ISP", - "ah": "ISP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LastSeenForUser", - "ah": "LastSeenForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LogonType", - "ah": "LogonType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OSPlatform", - "ah": "OSPlatform", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "UncommonForUser", - "ah": "UncommonForUser", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/items/4/content/query", - "sourceSha256": "5cfa1f00c5592101c3949fb5c9a4c844ca075b1967d5a978cf33e245e73f8570", - "targetSha256": "5cfa1f00c5592101c3949fb5c9a4c844ca075b1967d5a978cf33e245e73f8570" - }, - { - "sourcePath": "/items/6/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "3e17d55a70ce3cd304a47fd8785547f8446c7b115405e059c535d74209fb2b84" - }, - "conversion": { - "sourceId": "/items/6/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let data = IdentityQueryEvents\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"]);\r\ndata\r\n| summarize count() by QueryType, TO_DEVICE\r\n| join kind =inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by QueryType, TO_DEVICE\r\n) on $left.QueryType == $right.QueryType and $left.TO_DEVICE== $right.TO_DEVICE", - "resolvedTables": [ - "IdentityQueryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "IdentityQueryEvents", - "ahTable": "IdentityQueryEvents", - "identical": false, - "verdict": "Review", - "score": 0.962, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Query", - "ah": "Query", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "QueryTarget", - "ah": "QueryTarget", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "QueryType", - "ah": "QueryType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountUpn", - "ah": "TargetAccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/0/content/query", - "sourceSha256": "3e17d55a70ce3cd304a47fd8785547f8446c7b115405e059c535d74209fb2b84", - "targetSha256": "3e17d55a70ce3cd304a47fd8785547f8446c7b115405e059c535d74209fb2b84" - }, - { - "sourcePath": "/items/6/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "95283f26751ec86c6de1459cfe97ee649f8481a6d6418fc78507f088d94f2de9" - }, - "conversion": { - "sourceId": "/items/6/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let data = IdentityQueryEvents;\r\ndata\r\n| summarize count() by DeviceName\r\n| join kind =inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceName\r\n) on $left.DeviceName == $right.DeviceName", - "resolvedTables": [ - "IdentityQueryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "IdentityQueryEvents", - "ahTable": "IdentityQueryEvents", - "identical": false, - "verdict": "Review", - "score": 0.962, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Query", - "ah": "Query", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "QueryTarget", - "ah": "QueryTarget", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "QueryType", - "ah": "QueryType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountUpn", - "ah": "TargetAccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/1/content/query", - "sourceSha256": "95283f26751ec86c6de1459cfe97ee649f8481a6d6418fc78507f088d94f2de9", - "targetSha256": "95283f26751ec86c6de1459cfe97ee649f8481a6d6418fc78507f088d94f2de9" - }, - { - "sourcePath": "/items/7/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "4f8e6bd76cd92a3db0fd896f091c319f1f0b942ce7dbbbaa6472f1f04c13a5f2" - }, - "conversion": { - "sourceId": "/items/7/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "IdentityDirectoryEvents\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ActionType ", - "resolvedTables": [ - "IdentityDirectoryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "IdentityDirectoryEvents", - "ahTable": "IdentityDirectoryEvents", - "identical": false, - "verdict": "Review", - "score": 0.958, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ISP", - "ah": "ISP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountUpn", - "ah": "TargetAccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/0/content/query", - "sourceSha256": "4f8e6bd76cd92a3db0fd896f091c319f1f0b942ce7dbbbaa6472f1f04c13a5f2", - "targetSha256": "4f8e6bd76cd92a3db0fd896f091c319f1f0b942ce7dbbbaa6472f1f04c13a5f2" - }, - { - "sourcePath": "/items/7/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "3f319e748402bcf0ba8649c89a5383c670424c4cc5a63a5ed81106203cebc26c" - }, - "conversion": { - "sourceId": "/items/7/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "IdentityDirectoryEvents\r\n| summarize count() by ActionType \r\n| order by count_ desc", - "resolvedTables": [ - "IdentityDirectoryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "IdentityDirectoryEvents", - "ahTable": "IdentityDirectoryEvents", - "identical": false, - "verdict": "Review", - "score": 0.958, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ISP", - "ah": "ISP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountUpn", - "ah": "TargetAccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/1/content/query", - "sourceSha256": "3f319e748402bcf0ba8649c89a5383c670424c4cc5a63a5ed81106203cebc26c", - "targetSha256": "3f319e748402bcf0ba8649c89a5383c670424c4cc5a63a5ed81106203cebc26c" - }, - { - "sourcePath": "/items/7/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "afc2fa77334567ca35b171baeda269dde85f980999bdd6be7054bd7767516154" - }, - "conversion": { - "sourceId": "/items/7/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "IdentityDirectoryEvents\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn", - "resolvedTables": [ - "IdentityDirectoryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "IdentityDirectoryEvents", - "ahTable": "IdentityDirectoryEvents", - "identical": false, - "verdict": "Review", - "score": 0.958, - "columns": [ - { - "sentinel": "AccountDisplayName", - "ah": "AccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountDomain", - "ah": "AccountDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountName", - "ah": "AccountName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountObjectId", - "ah": "AccountObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountSid", - "ah": "AccountSid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AccountUpn", - "ah": "AccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ActionType", - "ah": "ActionType", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "Application", - "ah": "Application", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationDeviceName", - "ah": "DestinationDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationIPAddress", - "ah": "DestinationIPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DestinationPort", - "ah": "DestinationPort", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "DeviceName", - "ah": "DeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IPAddress", - "ah": "IPAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ISP", - "ah": "ISP", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Location", - "ah": "Location", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Port", - "ah": "Port", - "laType": "string", - "ahType": "int", - "relation": "castNeeded" - }, - { - "sentinel": "Protocol", - "ah": "Protocol", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountDisplayName", - "ah": "TargetAccountDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetAccountUpn", - "ah": "TargetAccountUpn", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TargetDeviceName", - "ah": "TargetDeviceName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/2/content/query", - "sourceSha256": "afc2fa77334567ca35b171baeda269dde85f980999bdd6be7054bd7767516154", - "targetSha256": "afc2fa77334567ca35b171baeda269dde85f980999bdd6be7054bd7767516154" - }, - { - "sourcePath": "/items/8/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "37f8548ab5ffd9ba6937928d97cdecd6c65534cbb1b0d114712f74133de4673a" - }, - "conversion": { - "sourceId": "/items/8/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let data = SecurityAlert\r\n| where ProductName == \"Azure Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated,*) by SystemAlertId;\r\ndata\r\n| summarize count() by AlertName\r\n| join kind=inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AlertName\r\n) on AlertName", - "resolvedTables": [ - "SecurityAlert" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "SecurityAlert", - "ahTable": "SecurityAlert", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 32, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/8/content/items/0/content/query", - "sourceSha256": "37f8548ab5ffd9ba6937928d97cdecd6c65534cbb1b0d114712f74133de4673a", - "targetSha256": "37f8548ab5ffd9ba6937928d97cdecd6c65534cbb1b0d114712f74133de4673a" - }, - { - "sourcePath": "/items/8/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "5f33bbfe47586c729e16cc1bf5de5b4a28ecf8fb6b6c2337e357a6bfbbe7c778" - }, - "conversion": { - "sourceId": "/items/8/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let data = SecurityAlert\r\n| where ProductName == \"Azure Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated,*) by SystemAlertId\r\n| mv-expand todynamic(Entities)\r\n| where Entities[\"Type\"] == \"host\"\r\n| where isnotempty(Entities[\"HostName\"])\r\n| extend HostName = tostring(Entities[\"HostName\"]);\r\ndata\r\n| summarize count() by HostName\r\n| join kind=inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by HostName\r\n) on $left.HostName == $right.HostName", - "resolvedTables": [ - "SecurityAlert" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "SecurityAlert", - "ahTable": "SecurityAlert", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 32, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/8/content/items/1/content/query", - "sourceSha256": "5f33bbfe47586c729e16cc1bf5de5b4a28ecf8fb6b6c2337e357a6bfbbe7c778", - "targetSha256": "5f33bbfe47586c729e16cc1bf5de5b4a28ecf8fb6b6c2337e357a6bfbbe7c778" - } - ] - }, + "format": "public-workbook-v1", + "origin": "sentinel-migration", "requiredWorkloads": [ { "workload": "mdi", @@ -5438,6 +907,6 @@ ] } ], - "dependencyReviewRequired": false + "requiredWorkspaceFunctions": [] } } diff --git a/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForOffice365detectionsandinsights.json b/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForOffice365detectionsandinsights.json index 5daadeab4ac..beb32a2ef23 100644 --- a/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForOffice365detectionsandinsights.json +++ b/Solutions/Microsoft Defender XDR/XDR Workbooks/MicrosoftDefenderForOffice365detectionsandinsights.json @@ -4,7 +4,7 @@ { "type": 1, "content": { - "json": "\n\n \n \n \n \n
\n Microsoft Defender for Office 365 Detections and Insights\n \n \n\t
\n\n\n\n\n
This workbook template provides an example of how to visualise and gain insights into Microsoft Defender for Office 365.
It allows you to visualise Microsoft Defender for Office 365 (MDO) data based on your organisation needs.
The workbook uses data from hunting tables streamed from Microsoft Defender XDR via the Microsoft Sentinel Connector. Keep the data in the Log Analytics workspace for as long as necessary to get insights over an extended period, based on your organisation's needs.
\n\n> \n**Please note:** *The workbook has a total of 14 tabs. If not all tabs are visible, you can access the remaining tabs using the \"...\" located at the end of the tab list on the right side.*\n> \n\n---\n\n\n\n> **Multi-tenant / multi-workspace:** select one or more workspaces in the **Workspace** filter to view data across them in a single view. For cross-tenant (MSSP) scenarios, onboard customer tenants with **Azure Lighthouse** (their workspaces then appear in the selectors) or use **Microsoft Defender multi-tenant management** in the Defender portal. For performance, keep to ~5–10 workspaces per view." + "json": "\n\n \n \n \n \n
\n Microsoft Defender for Office 365 Detections and Insights\n \n \n\t
\n\n\n\n\n
This workbook template provides an example of how to visualise and gain insights into Microsoft Defender for Office 365.
It allows you to visualise Microsoft Defender for Office 365 (MDO) data based on your organisation needs.
The workbook queries Microsoft Defender XDR advanced hunting tables in the Defender portal. Available data depends on your licensing, permissions, connected data sources and retention.
\n\n> \n**Please note:** *The workbook has a total of 14 tabs. If not all tabs are visible, you can access the remaining tabs using the \"...\" located at the end of the tab list on the right side.*\n> \n\n---\n\n> **Scope and filters:** use **TimeRange** and **Trend interval** to control the period and trend grouping. This XDR workbook does not provide a Workspace selector. Query scope follows the Defender portal's current data access context." }, "name": "text - 2", "id": "d2b45ab8-a1c1-43d2-853d-290640bf4c94" @@ -8750,7 +8750,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", + "query": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, Subject, TeamsMessageId", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", @@ -8777,7 +8777,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", + "query": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, Subject, TeamsMessageId", "size": 3, "showAnalytics": true, "timeContextFromParameter": "TimeRange", @@ -13779,7 +13779,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "// Identify MDO-related SecurityIncident IDs via alert correlation\r\nlet EmailSecurityIncidents = \r\n SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for MDO-related incidents\r\nlet LatestMdoIncidents =\r\n SecurityIncident\r\n | summarize arg_max(TimeGenerated, Classification, Status, IncidentName) by ProviderIncidentId\r\n | where ProviderIncidentId in (EmailSecurityIncidents)\r\n // Exclude other non-email incidents (e.g., DSPM with specific naming pattern)\r\n | where not(IncidentName startswith \"CC_\");\r\n\r\n// Compute true positive rate among closed MDO incidents\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| summarize\r\n TruePositiveCount = countif(Classification == \"TruePositive\"),\r\n TotalClosed = count()\r\n| extend TruePositiveRate = iff(\r\n TotalClosed > 0,\r\n TruePositiveCount * 100.0 / TotalClosed,\r\n real(null)\r\n)", + "query": "// Identify MDO-related SecurityIncident IDs via alert correlation\r\nlet EmailSecurityIncidents = \r\n SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for MDO-related incidents\r\nlet LatestMdoIncidents =\r\n SecurityIncident\r\n | summarize arg_max(TimeGenerated, Classification, Status, Title) by ProviderIncidentId\r\n | where ProviderIncidentId in (EmailSecurityIncidents)\r\n // Exclude other non-email incidents (e.g., DSPM with specific naming pattern)\r\n | where not(Title startswith \"CC_\");\r\n\r\n// Compute true positive rate among closed MDO incidents\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| summarize\r\n TruePositiveCount = countif(Classification == \"TruePositive\"),\r\n TotalClosed = count()\r\n| extend TruePositiveRate = iff(\r\n TotalClosed > 0,\r\n TruePositiveCount * 100.0 / TotalClosed,\r\n real(null)\r\n)", "size": 1, "showAnalytics": true, "timeContextFromParameter": "TimeRange", @@ -13823,6 +13823,7 @@ "query": "//This queries shows the last activity on the Incident and attempts to display auto resolved incidents vs manual interaction.\r\n//Add strings for your automations if you rely on any other application/system\r\n//Fewer human-closed incidents (and a higher automated closure rate) generally indicates greater SecOps efficiency, as automation is successfully handling more work.\r\n\r\n// Identify MDO-related incidents by joining SecurityIncident and SecurityAlert\r\nlet EmailSecurityIncidents = SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get latest status of each incident and count closed incidents by who closed them\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\r\n| where ProviderIncidentId in (EmailSecurityIncidents)\r\n| where Status == 'Closed'\r\n| where not(Title startswith \"CC_\") // Exclude non-MDO incidents from DSPM policies\r\n| extend ClosedBy = iff( // Add strings for your automation systems\r\n tolower(ModifiedBy) has_any (\"system\",\"azure\",\"automation\",\"playbook\",\"microsoft xdr\",\"microsoft defender xdr\",\"created from alert\"),\r\n \"Automated\",\r\n \"Human\"\r\n )\r\n| summarize ClosedCount = count() by ClosedBy", "size": 3, "showAnalytics": true, + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart" }, @@ -14020,6 +14021,7 @@ "query": "//This query shows if the action taken after an Automated Investigation required manual approval by and admin or was automatically taken\r\nEmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionType == \"Automated Remediation\"\r\n| summarize count() by ActionTrigger", "size": 3, "showAnalytics": true, + "timeContextFromParameter": "TimeRange", "queryType": "advancedHunting", "visualization": "piechart" }, @@ -14257,63268 +14259,13 @@ "xdrMetadata": { "contentId": "e39952df-ba60-50cf-80f6-76f7a2ebf57c", "instanceId": "8f47d55b-34a6-5d13-a89f-315b1a2a4f53", - "version": "3.2.1", + "version": "3.2.2", "schemaVersion": "1.0.0", - "displayName": "MicrosoftDefenderForOffice365detectionsandinsights" + "displayName": "Microsoft Defender for Office 365 Detections and Insights" }, "contentProvenance": { - "source": { - "path": "Workbooks/MicrosoftDefenderForOffice365detectionsandinsights.json", - "sha256": "19bad5117876f5ea343e61de59a5c3bded01b6f1269d8d4e0fd17312d77140c3", - "contentId": "sentinel-MicrosoftDefenderForOffice365detectionsandinsights", - "originalMetadataVersion": null - }, - "conversion": { - "tool": "sentinel-xdr-migration", - "version": "0.1.0", - "reviewRequired": false, - "queries": [ - { - "sourcePath": "/items/1/content/parameters/0/query", - "status": "removed-scope-helper", - "outputPath": null, - "sourceSha256": "5946994a15739302ed2d73d8352ad7807cf022400d0fb4ada7deacc6a80a4362", - "targetSha256": null - }, - { - "sourcePath": "/items/1/content/parameters/1/query", - "status": "removed-scope-helper", - "outputPath": null, - "sourceSha256": "e9fbb9e0bbf1476452fd4bc3e09a7a3dce06ac3b0a38295589d65cc2d059d7df", - "targetSha256": null - }, - { - "sourcePath": "/items/1/content/parameters/2/query", - "status": "removed-scope-helper", - "outputPath": null, - "sourceSha256": "9ca49dd832750c2f8405091b4a93879c6da739076995018fd31782ebf5340075", - "targetSha256": null - }, - { - "sourcePath": "/items/1/content/parameters/3/query", - "status": "removed-scope-helper", - "outputPath": null, - "sourceSha256": "5c2a7488f97b3194e989f65b1ac348498bcd9c7451ae1e2302b349a68647aa03", - "targetSha256": null - }, - { - "sourcePath": "/items/3/content/items/0/content/items/1/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "5747115a77dbcf964a42a96f3c7e0dcb3c951fcba765c6c39eb83b68b46fd144" - }, - "conversion": { - "sourceId": "/items/3/content/items/0/content/items/1/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n\r\n// Get all mailflow detected as clean at time of delivery \r\nlet EmailEventsClean = materialize( \r\n EmailEvents \r\n | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\r\n // this alteration is due to the threat types being updated directly within advanced hunting.\r\n //| where DeliveryLocation != \"Quarantine\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\r\n | project NetworkMessageId,ThreatTypes \r\n); \r\n// Get all mailflow detected as phish or malware at time of delivery \r\nlet EmailEventsThreats = materialize( \r\n EmailEvents \r\n | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n | where ThreatTypes contains \"Phish\" or ThreatTypes contains \"Malware\" \r\n | extend MDO_detection = parse_json(DetectionMethods) \r\n | extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n | extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \r\n); \r\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \r\nlet EmailPostDeliveryFiltered = materialize( \r\n EmailPostDeliveryEvents \r\n | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \r\n | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") or Action has_any (\"Redelivery\",\"Reprocessed\") \r\n | extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n | summarize arg_max(Timestamp, *) by Key \r\n | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \r\n); \r\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \r\nlet CloudAppEventsFiltered = materialize( \r\n CloudAppEvents \r\n | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\r\n | where ActionType == \"AdminSubmissionSubmitted\" \r\n | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \r\n | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \r\n | where SubmissionType in (\"1\", \"2\") \r\n | project SubmissionType,NetworkMessageId \r\n); \r\n// get the number of threats caught in mailflow \r\nlet Mal_Phish_Mailflow = toscalar( \r\n EmailEventsThreats \r\n | summarize count() \r\n); \r\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \r\nlet FP_ZAP = toscalar( \r\n EmailPostDeliveryFiltered \r\n | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" and Action has_any (\"Redelivery\",\"Reprocessed\") \r\n | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \r\n | summarize count() \r\n); \r\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \r\nlet FN_ZAP_Successful = toscalar( \r\n EmailPostDeliveryFiltered \r\n | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult in (\"Success\",\"AdminPolicy\") \r\n | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n | summarize count() \r\n); \r\n// get the number of threats unsuccessfully cleaned up post delivery. \r\nlet FN_ZAP_Unsuccessful = toscalar( \r\n EmailPostDeliveryFiltered \r\n | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult !in (\"Success\",\"AdminPolicy\") \r\n | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n | summarize count() \r\n); \r\n// join the administrative submissions to clean mailflow to find the additional miss \r\nlet FN_Admin_Submissions = toscalar( \r\n CloudAppEventsFiltered \r\n | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \r\n | summarize count() \r\n ); \r\n // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \r\n\r\nprint StatisticName=\"Effectiveness Post Delivery\", Value=abs(round(((toreal(toscalar(FN_Admin_Submissions))+toreal(toscalar(FN_ZAP_Unsuccessful)))/(toreal(toscalar(Mal_Phish_Mailflow))+toreal(toscalar(FN_ZAP_Successful))+toreal(toscalar(FN_ZAP_Unsuccessful))+toreal(toscalar(FN_Admin_Submissions))-toreal(toscalar(FP_ZAP)))*100-100),2))", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/0/content/items/1/content/items/0/content/query", - "sourceSha256": "5747115a77dbcf964a42a96f3c7e0dcb3c951fcba765c6c39eb83b68b46fd144", - "targetSha256": "5747115a77dbcf964a42a96f3c7e0dcb3c951fcba765c6c39eb83b68b46fd144" - }, - { - "sourcePath": "/items/3/content/items/0/content/items/1/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965" - }, - "conversion": { - "sourceId": "/items/3/content/items/0/content/items/1/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\r\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\r\n| where Action == \"Quarantine release\"\r\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \"Quarantine\") on NetworkMessageId\r\n| summarize count());\r\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \"Quarantine\"\r\n| summarize count());\r\nprint\r\nQuarantine_Releases = toreal(Quarantine_Releases),\r\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\r\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))", - "resolvedTables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/0/content/items/1/content/items/1/content/query", - "sourceSha256": "b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965", - "targetSha256": "b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965" - }, - { - "sourcePath": "/items/3/content/items/0/content/items/2/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "21e6d6c3e7e489c5001e4b39a81275956d155e2d380328eb2f4ae61e973db708" - }, - "conversion": { - "sourceId": "/items/3/content/items/0/content/items/2/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query shows the number behind the effectiveness of phish and malware false positives including post delivery events but without edge data detections.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n\r\n// Get all mailflow detected as clean at time of delivery \r\nlet EmailEventsClean = materialize( \r\n EmailEvents \r\n | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" // UN-comment this when using sentinel or another streaming SIEM (line 10).\r\n // this alteration is due to the threat types being updated directly within advanced hunting.\r\n //| where DeliveryLocation != \"Quarantine\" // comment out this line if you uncomment line 10, as it's only required for advanced hunting.\r\n | project NetworkMessageId,ThreatTypes \r\n); \r\n// Get all mailflow detected as phish or malware at time of delivery \r\nlet EmailEventsThreats = materialize( \r\n EmailEvents \r\n | where Timestamp between (toscalar(minTime) .. toscalar(maxTime)) and EmailDirection == \"Inbound\" \r\n | where ThreatTypes contains \"Phish\" or ThreatTypes contains \"Malware\" \r\n | extend MDO_detection = parse_json(DetectionMethods) \r\n | extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n | extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n | project NetworkMessageId,FirstDetection,FirstSubcategory,MDO_detection,ThreatTypes \r\n); \r\n// Get all post delivery ZAP / Redelivery events, and arg_max them to ensure we have the latest verdict to work with for each \r\nlet EmailPostDeliveryFiltered = materialize( \r\n EmailPostDeliveryEvents \r\n | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime))) \r\n | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") or Action has_any (\"Redelivery\",\"Reprocessed\") \r\n | extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n | summarize arg_max(Timestamp, *) by Key \r\n | project Action,ActionType,ActionResult,ThreatTypes,NetworkMessageId \r\n); \r\n// Optional - get all admin submissions for malware or phish, so we can also count these in the miss bucket. \r\nlet CloudAppEventsFiltered = materialize( \r\n CloudAppEvents \r\n | where Timestamp between (toscalar(minTime) .. datetime_add('day', 7, toscalar(maxTime)))\r\n | where ActionType == \"AdminSubmissionSubmitted\" \r\n | extend SubmissionType = tostring(parse_json(RawEventData).SubmissionType) \r\n | extend NetworkMessageId = tostring(parse_json(RawEventData).ObjectId) \r\n | where SubmissionType in (\"1\", \"2\") \r\n | project SubmissionType,NetworkMessageId \r\n); \r\n// get the number of threats caught in mailflow \r\nlet Mal_Phish_Mailflow = toscalar( \r\n EmailEventsThreats \r\n | summarize count() \r\n); \r\n// get the number of threats caught in mailflow which turned out to be false positives (FPs) so we can correct the calculation \r\nlet FP_ZAP = toscalar( \r\n EmailPostDeliveryFiltered \r\n | where ThreatTypes !contains \"Phish\" and ThreatTypes !contains \"Malware\" and Action has_any (\"Redelivery\",\"Reprocessed\") \r\n | join kind=leftsemi (EmailEventsThreats) on NetworkMessageId \r\n | summarize count() \r\n); \r\n// get the number of threats successfully cleaned up post delivery, ignoring where administrative policy stopped action \r\nlet FN_ZAP_Successful = toscalar( \r\n EmailPostDeliveryFiltered \r\n | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult in (\"Success\",\"AdminPolicy\") \r\n | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n | summarize count() \r\n); \r\n// get the number of threats unsuccessfully cleaned up post delivery. \r\nlet FN_ZAP_Unsuccessful = toscalar( \r\n EmailPostDeliveryFiltered \r\n | where ActionType in (\"Malware ZAP\",\"Phish ZAP\") and ActionResult !in (\"Success\",\"AdminPolicy\") \r\n | join kind=leftsemi (EmailEventsClean) on NetworkMessageId \r\n | summarize count() \r\n); \r\n// join the administrative submissions to clean mailflow to find the additional miss \r\nlet FN_Admin_Submissions = toscalar( \r\n CloudAppEventsFiltered \r\n | join kind=rightsemi (EmailEventsClean) on NetworkMessageId \r\n | summarize count() \r\n ); \r\n // print each result, and run the calculation to work out effectiveness at time of delivery and post delivery. \r\nunion withsource=Table \r\n (print StatisticName=\"Mal/Phish Mailflow totals - Minus FPs\", Value=toreal(Mal_Phish_Mailflow) - toreal(FP_ZAP)), \r\n (print StatisticName=\"Admin Mal/Phish FNs Submitted\", Value=toreal(FN_Admin_Submissions)), \r\n (print StatisticName=\"Mal/Phish FPs Reverse Zapped\", Value=toreal(FP_ZAP)), \r\n (print StatisticName=\"Mal / Phish Successfully Zapped\", Value=toreal(FN_ZAP_Successful)), \r\n (print StatisticName=\"Mal / Phish UN-Successfully Zapped\", Value=toreal(FN_ZAP_Unsuccessful)), \r\n (print StatisticName=\"Effectiveness Post Delivery (%)\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))), \r\n (print StatisticName=\"Effectiveness Pre-Delivery (%)\", Value=abs(round(((toreal(FN_Admin_Submissions)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_ZAP_Successful))/(toreal(Mal_Phish_Mailflow)+toreal(FN_ZAP_Successful)+toreal(FN_ZAP_Unsuccessful)+toreal(FN_Admin_Submissions)-toreal(FP_ZAP))*100-100),2))) \r\n| project StatisticName, Value", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/0/content/items/2/content/items/1/content/query", - "sourceSha256": "21e6d6c3e7e489c5001e4b39a81275956d155e2d380328eb2f4ae61e973db708", - "targetSha256": "21e6d6c3e7e489c5001e4b39a81275956d155e2d380328eb2f4ae61e973db708" - }, - { - "sourcePath": "/items/3/content/items/0/content/items/3/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "85ed7ec77cc8bf2b0ea05d753a5eb3285800b15fae28dac80145460883f101c7" - }, - "conversion": { - "sourceId": "/items/3/content/items/0/content/items/3/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Per detection technology: the share of its quarantined emails later released from quarantine (a high rate can indicate false positives). Top 7 by release rate; detectors with <10 quarantined excluded so the rate is meaningful.\r\nEmailEvents\r\n| where DeliveryLocation == \"Quarantine\"\r\n| extend MDO_detection = parse_json(DetectionMethods)\r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\")\r\n| where FirstSubcategory contains \"Malware\" or FirstSubcategory contains \"Phish\"\r\n| join kind=leftouter (\r\n EmailPostDeliveryEvents\r\n | where Action == \"Quarantine release\"\r\n | distinct NetworkMessageId\r\n | extend ReleasedFlag = \"yes\"\r\n ) on NetworkMessageId\r\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \"yes\") by FirstSubcategory\r\n| where Quarantined >= 10 and Released > 0\r\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\r\n| project ['Detection Technology']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\r\n| order by ['Release %'] desc\r\n| take 7", - "resolvedTables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/0/content/items/3/content/items/1/content/query", - "sourceSha256": "85ed7ec77cc8bf2b0ea05d753a5eb3285800b15fae28dac80145460883f101c7", - "targetSha256": "85ed7ec77cc8bf2b0ea05d753a5eb3285800b15fae28dac80145460883f101c7" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "54c5da330fa9d7f225441bf1d9d0a714ca10e676ddc26acfa7c972e1037bbf69" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let base = materialize(EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize arg_max(Timestamp, ThreatTypes, DeliveryAction, OrgLevelPolicy, OrgLevelAction, UserLevelAction) by Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress));\r\nlet agg = materialize(base | summarize\r\n Total = count(),\r\n Filtered = countif(isnotempty(ThreatTypes) and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n FMal = countif(ThreatTypes has \"Malware\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n FPhish = countif(ThreatTypes has \"Phish\" and not(ThreatTypes has \"Malware\") and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n FSpam = countif(ThreatTypes == \"Spam\" and DeliveryAction != \"Delivered\" and OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")),\r\n Deliv = countif(isnotempty(ThreatTypes) and DeliveryAction == \"Delivered\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\r\n Blocked = countif(isempty(ThreatTypes) and DeliveryAction != \"Delivered\" and (isnotempty(OrgLevelAction) or isnotempty(UserLevelAction))),\r\n Clean = countif(isempty(ThreatTypes) and DeliveryAction == \"Delivered\"));\r\nlet pd = materialize(EmailPostDeliveryEvents | where ActionResult == \"Success\" | summarize MalZap = countif(ActionType == \"Malware ZAP\"), PhishZap = countif(ActionType == \"Phish ZAP\"), SpamZap = countif(ActionType == \"Spam ZAP\"));\r\nlet sub = materialize(CloudAppEvents | extend R = tostring(parse_json(RawEventData).RecordType), SCT = tostring(parse_json(RawEventData).SubmissionContentType) | where R == \"29\" | summarize Adm = countif(ActionType == \"AdminSubmissionSubmitted\" and SCT == \"Mail\"), Usr = countif(ActionType == \"UserSubmission\"));\r\nlet Total = toscalar(agg | project Total);\r\nlet Filtered = toscalar(agg | project Filtered);\r\nlet FMal = toscalar(agg | project FMal);\r\nlet FPhish = toscalar(agg | project FPhish);\r\nlet FSpam = toscalar(agg | project FSpam);\r\nlet Deliv = toscalar(agg | project Deliv);\r\nlet Blocked = toscalar(agg | project Blocked);\r\nlet Clean = toscalar(agg | project Clean);\r\nlet MalZap = toscalar(pd | project MalZap);\r\nlet PhishZap = toscalar(pd | project PhishZap);\r\nlet SpamZap = toscalar(pd | project SpamZap);\r\nlet Adm = toscalar(sub | project Adm);\r\nlet Usr = toscalar(sub | project Usr);\r\nunion\r\n (print o = 1, Name = \"Total Inbound Emails\", Count = Total),\r\n (print o = 2, Name = \"    Filtering Totals\", Count = Filtered),\r\n (print o = 3, Name = \"        Filtered as Malware\", Count = FMal),\r\n (print o = 4, Name = \"        Filtered as Phish\", Count = FPhish),\r\n (print o = 5, Name = \"        Filtered as Spam\", Count = FSpam),\r\n (print o = 6, Name = \"    Delivered with Detection\", Count = Deliv),\r\n (print o = 7, Name = \"    User/Admin Blocked\", Count = Blocked),\r\n (print o = 8, Name = \"    Clean Emails\", Count = Clean),\r\n (print o = 9, Name = \"Post-Delivery ZAP Removals\", Count = MalZap + PhishZap + SpamZap),\r\n (print o = 10, Name = \"    Removed by Malware ZAP\", Count = MalZap),\r\n (print o = 11, Name = \"    Removed by Phish ZAP\", Count = PhishZap),\r\n (print o = 12, Name = \"    Removed by Spam ZAP\", Count = SpamZap),\r\n (print o = 13, Name = \"User/Admin Reported\", Count = Adm + Usr),\r\n (print o = 14, Name = \"    Reported by Admins\", Count = Adm),\r\n (print o = 15, Name = \"    Reported by Users\", Count = Usr)\r\n| sort by o asc\r\n| extend [\"% of Inbound\"] = round(Count * 100.0 / Total, 1)\r\n| project Name, Count, [\"% of Inbound\"]", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/2/content/query", - "sourceSha256": "54c5da330fa9d7f225441bf1d9d0a714ca10e676ddc26acfa7c972e1037bbf69", - "targetSha256": "54c5da330fa9d7f225441bf1d9d0a714ca10e676ddc26acfa7c972e1037bbf69" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/3/content/items/0/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "5ea9001623bf807401855ab2dc1227cc2028df25607fe48dd189eed3403c66cc" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/3/content/items/0/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count = count()\r\n| extend Details = \"Total Inbound Emails\";", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/3/content/items/0/content/items/0/content/query", - "sourceSha256": "5ea9001623bf807401855ab2dc1227cc2028df25607fe48dd189eed3403c66cc", - "targetSha256": "5ea9001623bf807401855ab2dc1227cc2028df25607fe48dd189eed3403c66cc" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "11024d9cb81b049a21e345bc5524f772f9154ffa2308755d5e91d7640e03a000" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/3/content/items/1/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where isnotempty(ThreatTypes) and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count = count()\r\n| extend Details = \"Filtering Totals\";", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/0/content/query", - "sourceSha256": "11024d9cb81b049a21e345bc5524f772f9154ffa2308755d5e91d7640e03a000", - "targetSha256": "11024d9cb81b049a21e345bc5524f772f9154ffa2308755d5e91d7640e03a000" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "28cafb2e50cec0219284436da53500fb14de8f6f152b78f9fb7b46de674ef36d" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/3/content/items/1/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises Total emails detected as Malware\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes has ('Malware') and EmailDirection == \"Inbound\"\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Malware\"", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/1/content/query", - "sourceSha256": "28cafb2e50cec0219284436da53500fb14de8f6f152b78f9fb7b46de674ef36d", - "targetSha256": "28cafb2e50cec0219284436da53500fb14de8f6f152b78f9fb7b46de674ef36d" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "317de152ba920fdf351f7321099fdeabdc9976846d339eb9b88fdde797cb3eea" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/3/content/items/1/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises Total emails detected as Phish\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes has \"Phish\" and not(ThreatTypes has \"Malware\") and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Phish\"", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/2/content/query", - "sourceSha256": "317de152ba920fdf351f7321099fdeabdc9976846d339eb9b88fdde797cb3eea", - "targetSha256": "317de152ba920fdf351f7321099fdeabdc9976846d339eb9b88fdde797cb3eea" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "2c92c916613af150c9fb9002575262812efe51a25f3e895f7b13c48cd2cd5f75" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/3/content/items/1/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises Total emails by detected as Spam\r\nEmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| where ThreatTypes == 'Spam' and EmailDirection == \"Inbound\" and DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"Emails Filtered as Spam\"", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/3/content/items/1/content/items/3/content/query", - "sourceSha256": "2c92c916613af150c9fb9002575262812efe51a25f3e895f7b13c48cd2cd5f75", - "targetSha256": "2c92c916613af150c9fb9002575262812efe51a25f3e895f7b13c48cd2cd5f75" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/3/content/items/2/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "6d26ede06beed91a44a33f5e92d356dbda265fb9d28a08085a8b9c1a20ab222d" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/3/content/items/2/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and DeliveryAction == 'Delivered'\r\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count= count()\r\n| extend Details = \"Delivered with Detection\"", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/3/content/items/2/content/items/0/content/query", - "sourceSha256": "6d26ede06beed91a44a33f5e92d356dbda265fb9d28a08085a8b9c1a20ab222d", - "targetSha256": "6d26ede06beed91a44a33f5e92d356dbda265fb9d28a08085a8b9c1a20ab222d" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/3/content/items/2/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "0dd446cd43e873feeeb05f3fb5d66fee5c565c5b31ea65512c4e667343eeae2e" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/3/content/items/2/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isempty(ThreatTypes) \r\n| where isnotempty(OrgLevelAction) or isnotempty(UserLevelAction)\r\n| where DeliveryAction != 'Delivered'\r\n| summarize Count= count()\r\n| extend Details = \"User/Admin Blocked\"", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/3/content/items/2/content/items/1/content/query", - "sourceSha256": "0dd446cd43e873feeeb05f3fb5d66fee5c565c5b31ea65512c4e667343eeae2e", - "targetSha256": "0dd446cd43e873feeeb05f3fb5d66fee5c565c5b31ea65512c4e667343eeae2e" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/3/content/items/2/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "07b6448883cc7e806585aa65b32d23f9885de98f00db547259bf3abc51782695" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/3/content/items/2/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailEvents\r\n| where isempty(ThreatTypes) and EmailDirection == \"Inbound\" and DeliveryAction == 'Delivered'\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key \r\n| summarize Count= count()\r\n| extend Details = \"Clean Emails\"", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/3/content/items/2/content/items/2/content/query", - "sourceSha256": "07b6448883cc7e806585aa65b32d23f9885de98f00db547259bf3abc51782695", - "targetSha256": "07b6448883cc7e806585aa65b32d23f9885de98f00db547259bf3abc51782695" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/3/content/items/3/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "e1a57a032e584b925d55abf853598511c207c992fba71727c350eb2fbe9a7955" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/3/content/items/3/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Malware ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Malware ZAP\"\r\n", - "resolvedTables": [ - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/3/content/items/3/content/items/0/content/query", - "sourceSha256": "e1a57a032e584b925d55abf853598511c207c992fba71727c350eb2fbe9a7955", - "targetSha256": "e1a57a032e584b925d55abf853598511c207c992fba71727c350eb2fbe9a7955" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/3/content/items/3/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "bfe851f071babb9c7bdb272265c227c0e5b412e8a2b45f2e650105234bed34d4" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/3/content/items/3/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Phish ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Phish ZAP\"", - "resolvedTables": [ - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/3/content/items/3/content/items/1/content/query", - "sourceSha256": "bfe851f071babb9c7bdb272265c227c0e5b412e8a2b45f2e650105234bed34d4", - "targetSha256": "bfe851f071babb9c7bdb272265c227c0e5b412e8a2b45f2e650105234bed34d4" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/3/content/items/3/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "a3d38b001812d4243757f54d219cc3483324bfe96169a973957f48e8f38b9661" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/3/content/items/3/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "EmailPostDeliveryEvents\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Spam ZAP\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Removed by Spam ZAP\"", - "resolvedTables": [ - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/3/content/items/3/content/items/2/content/query", - "sourceSha256": "a3d38b001812d4243757f54d219cc3483324bfe96169a973957f48e8f38b9661", - "targetSha256": "a3d38b001812d4243757f54d219cc3483324bfe96169a973957f48e8f38b9661" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/3/content/items/4/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "ca205c791cd98cc9ca1dd117e21f72b3ec9297eac3d66edc502ea235b2c00771" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/3/content/items/4/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\r\nCloudAppEvents\r\n| extend Record= (parse_json(RawEventData)).RecordType\r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Reported by Admins\"", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/3/content/items/4/content/items/0/content/query", - "sourceSha256": "ca205c791cd98cc9ca1dd117e21f72b3ec9297eac3d66edc502ea235b2c00771", - "targetSha256": "ca205c791cd98cc9ca1dd117e21f72b3ec9297eac3d66edc502ea235b2c00771" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/3/content/items/4/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "7e3420b2827239bf920fb9719d44a299424cae3a7814795abbc9c07efbae589f" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/3/content/items/4/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails reported by user and total emails reported by Admins as false positive or false negative detection\r\nCloudAppEvents\r\n| extend Record= (parse_json(RawEventData)).RecordType\r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState\r\n| where Record == 29 and ActionType == \"UserSubmission\"\r\n| summarize Count= count()\r\n| extend Details = \"Total Emails Reported by Users\"\r\n", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/3/content/items/4/content/items/1/content/query", - "sourceSha256": "7e3420b2827239bf920fb9719d44a299424cae3a7814795abbc9c07efbae589f", - "targetSha256": "7e3420b2827239bf920fb9719d44a299424cae3a7814795abbc9c07efbae589f" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "29e1433c6e19b5452fe2be9b62bcf61ad37e29d746484dbfa5a645054e30a3cc" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query surfaces the users most targeted by inbound email threats across all threat types (malware, phishing, spam) for the selected period, so SecOps can prioritise the highest-risk individuals. Similar to a \"Most Attacked People\" view.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where isnotempty(ThreatTypes)\r\n| summarize\r\n ['Total Threats'] = count(),\r\n Malware = countif(ThreatTypes has \"Malware\"),\r\n Phish = countif(ThreatTypes has \"Phish\"),\r\n Spam = countif(ThreatTypes has \"Spam\"),\r\n ['Last Seen'] = max(Timestamp)\r\n by ['User']=RecipientEmailAddress\r\n| top 10 by ['Total Threats']\r\n| project ['User'], ['Total Threats'], Malware, Phish, Spam, ['Last Seen']", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/5/content/query", - "sourceSha256": "29e1433c6e19b5452fe2be9b62bcf61ad37e29d746484dbfa5a645054e30a3cc", - "targetSha256": "29e1433c6e19b5452fe2be9b62bcf61ad37e29d746484dbfa5a645054e30a3cc" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "5c341f1f2dbee19255c01125ce8be61b3a9ae6e65b982e4170f53e132c40148f" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails, total detections, total user, and admin email submissions over time summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet scaffold = range Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran;\r\nlet baseQuery = materialize(EmailEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where isnotempty(Timestamp));\r\nlet sub = materialize(CloudAppEvents\r\n| extend Record = (parse_json(RawEventData)).RecordType, SubmissionContentType = tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29);\r\nlet zapbase = EmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionResult == \"Success\"\r\n| where ActionType == \"Phish ZAP\" or ActionType == \"Malware ZAP\" or ActionType == \"Spam ZAP\";\r\nunion\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Inbound\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Inbound Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Phish') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Phish\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Malware') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Malware\"),\r\n(scaffold | join kind=leftouter (baseQuery | where ThreatTypes has ('Spam') | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Emails Detected as Spam\"),\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Intra-org\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Intra-org Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where EmailDirection == \"Outbound\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Outbound Emails\"),\r\n(scaffold | join kind=leftouter (baseQuery | where isnotempty(ThreatTypes) | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails with Threat\"),\r\n(scaffold | join kind=leftouter (sub | where ActionType == \"UserSubmission\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Reported by Users\"),\r\n(scaffold | join kind=leftouter (zapbase | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Removed by ZAP\"),\r\n(scaffold | join kind=leftouter (sub | where ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType == \"Mail\" | summarize Count = count() by Timestamp = bin(Timestamp, gran)) on Timestamp | project Timestamp, Count = coalesce(Count, 0), Details = \"Total Emails Reported by Admins\")", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/7/content/query", - "sourceSha256": "5c341f1f2dbee19255c01125ce8be61b3a9ae6e65b982e4170f53e132c40148f", - "targetSha256": "5c341f1f2dbee19255c01125ce8be61b3a9ae6e65b982e4170f53e132c40148f" - }, - { - "sourcePath": "/items/3/content/items/1/content/items/9/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "134d3d4d6893f1d88c14e42b7976e21006dabba9d3fc71dd58a55e0ca52db645" - }, - "conversion": { - "sourceId": "/items/3/content/items/1/content/items/9/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises bad traffic (% of emails with threats) compared to total inbound emails over time summarising the data daily.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n BadEmailCount = countif(isnotempty(ThreatTypes)) by bin(Timestamp, {Granularity})\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(BadEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| project Timestamp, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/1/content/items/9/content/query", - "sourceSha256": "134d3d4d6893f1d88c14e42b7976e21006dabba9d3fc71dd58a55e0ca52db645", - "targetSha256": "134d3d4d6893f1d88c14e42b7976e21006dabba9d3fc71dd58a55e0ca52db645" - }, - { - "sourcePath": "/items/3/content/items/2/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "554088d9c128e08443f51fecd276d5435baaa56ab9f2dd744e1325fc0c0d4132" - }, - "conversion": { - "sourceId": "/items/3/content/items/2/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Headline Microsoft Teams / collaboration protection metrics for the executive summary, with per-interval sparklines so the collaboration threat trend is visible at a glance. Messages and URLs are counted per distinct Teams message.\r\nlet gran = {Granularity};\r\nlet me = materialize(MessageEvents);\r\nlet cae = materialize(CloudAppEvents | where ActionType == \"TeamsImpersonationDetected\");\r\nlet mui = materialize(MessageUrlInfo);\r\nlet uce = materialize(UrlClickEvents | where Workload == \"Teams\" and ActionType in (\"ClickBlocked\",\"ClickBlockedByTenantPolicy\"));\r\nlet fmc = materialize(FileMaliciousContentInfo | where Workload == \"MicrosoftTeams\");\r\nunion\r\n(me | summarize Count = dcount(TeamsMessageId) | extend Details = \"Teams Messages Scanned\", Ord = 1, Trend = toscalar(me | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(me | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Teams Threat Messages\", Ord = 2, Trend = toscalar(me | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(cae | summarize Count = count() | extend Details = \"Teams Impersonation Detections\", Ord = 3, Trend = toscalar(cae | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(mui | summarize Count = dcount(TeamsMessageId) | extend Details = \"URLs Shared in Teams\", Ord = 4, Trend = toscalar(mui | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(uce | summarize Count = count() | extend Details = \"Malicious Clicks Blocked\", Ord = 5, Trend = toscalar(uce | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(fmc | summarize Count = count() | extend Details = \"Teams Files Scanned\", Ord = 6, Trend = toscalar(fmc | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(fmc | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Malicious Teams Files\", Ord = 7, Trend = toscalar(fmc | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend", - "resolvedTables": [ - "CloudAppEvents", - "FileMaliciousContentInfo", - "MessageEvents", - "MessageUrlInfo", - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "FileMaliciousContentInfo", - "ahTable": "FileMaliciousContentInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 17, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - }, - { - "sentinelTable": "MessageUrlInfo", - "ahTable": "MessageUrlInfo", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - }, - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/2/content/items/1/content/query", - "sourceSha256": "554088d9c128e08443f51fecd276d5435baaa56ab9f2dd744e1325fc0c0d4132", - "targetSha256": "554088d9c128e08443f51fecd276d5435baaa56ab9f2dd744e1325fc0c0d4132" - }, - { - "sourcePath": "/items/3/content/items/4/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "a691b608e29297a7398550427e7dc2331253dfba5a35075418caf680155de8a8" - }, - "conversion": { - "sourceId": "/items/3/content/items/4/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "datatable(Index:int, Name:string, Value:int)\r\n[\r\n 1, \"Defender for Office 365\", 194,\r\n 2, \"Mimecast\", 478,\r\n 3, \"ProofPoint\", 483,\r\n 4, \"HornetSecurity\", 813,\r\n 5, \"TrendMicro\", 1151,\r\n 6, \"IronPort\", 1274,\r\n 7, \"Barracuda\", 1585,\r\n 8, \"FireEye\", 2107\r\n]\r\n| project [\"Email security solution\"] = Name, [\"High-severity threats missed / 1K users\"] = Value\r\n| order by [\"High-severity threats missed / 1K users\"] asc\r\n", - "resolvedTables": [], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/3/content/items/4/content/items/1/content/query", - "sourceSha256": "a691b608e29297a7398550427e7dc2331253dfba5a35075418caf680155de8a8", - "targetSha256": "a691b608e29297a7398550427e7dc2331253dfba5a35075418caf680155de8a8" - }, - { - "sourcePath": "/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "1fd59e604c53e89e68e79492437b58352dad05c2a44a165056a653932c3b7412" - }, - "conversion": { - "sourceId": "/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//KPI summary of inbound email malware detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet mal = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Malware\";\r\nlet inbox = mal | where DeliveryLocation has \"Inbox\";\r\nlet malTrend = toscalar(mal | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(mal | summarize count()), Details = \"Malware Emails\", Ord = 1, Trend = malTrend),\r\n(print Count = toscalar(mal | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = malTrend),\r\n(print Count = toscalar(mal | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = malTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/5/content/query", - "sourceSha256": "1fd59e604c53e89e68e79492437b58352dad05c2a44a165056a653932c3b7412", - "targetSha256": "1fd59e604c53e89e68e79492437b58352dad05c2a44a165056a653932c3b7412" - }, - { - "sourcePath": "/items/6/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "a1eb72881852a12eabc2a4e37363a0520a5c4aaccb1e097ace271ca50e8a6674" - }, - "conversion": { - "sourceId": "/items/6/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Malware detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents \r\n| where ThreatTypes has \"Malware\" \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize MalwareDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, MalwareDetections = coalesce(MalwareDetections, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/2/content/query", - "sourceSha256": "a1eb72881852a12eabc2a4e37363a0520a5c4aaccb1e097ace271ca50e8a6674", - "targetSha256": "a1eb72881852a12eabc2a4e37363a0520a5c4aaccb1e097ace271ca50e8a6674" - }, - { - "sourcePath": "/items/6/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "16d0ddfd2281229a57f0213b0c71fdee484fd1ce15b8992838ab99c69a595c38" - }, - "conversion": { - "sourceId": "/items/6/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Malware detections over time summarizing the data daily by Malware detection technologies/controls used for detecting unknown-unique malware.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| where MalwareMethod in ('File detonation','URL detonation')\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/4/content/query", - "sourceSha256": "16d0ddfd2281229a57f0213b0c71fdee484fd1ce15b8992838ab99c69a595c38", - "targetSha256": "16d0ddfd2281229a57f0213b0c71fdee484fd1ce15b8992838ab99c69a595c38" - }, - { - "sourcePath": "/items/6/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "ddd5a7b2f07acbb2d84ca0dc89914b9f9ddc7f535c41e33aa91935489274b85e" - }, - "conversion": { - "sourceId": "/items/6/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Malware detections summarizing the data by threat classification of the malware threat in the message.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has 'Malware' and ThreatClassification has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count(Key) by ThreatClassification\r\n| sort by Count desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/8/content/query", - "sourceSha256": "ddd5a7b2f07acbb2d84ca0dc89914b9f9ddc7f535c41e33aa91935489274b85e", - "targetSha256": "ddd5a7b2f07acbb2d84ca0dc89914b9f9ddc7f535c41e33aa91935489274b85e" - }, - { - "sourcePath": "/items/6/content/items/9/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "81cc0526ceb03ef05cb2fbe47616c4a345f2a417d517a6677ad6177d152f6ecf" - }, - "conversion": { - "sourceId": "/items/6/content/items/9/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises Malware detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Malware\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Adware\",\"Downloader\",\"HackTool\",\"Ransomware\",\"Remote access trojan\",\"Spyware\")\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\r\n| summarize Count = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\r\n| sort by Count desc\r\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Count", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/9/content/query", - "sourceSha256": "81cc0526ceb03ef05cb2fbe47616c4a345f2a417d517a6677ad6177d152f6ecf", - "targetSha256": "81cc0526ceb03ef05cb2fbe47616c4a345f2a417d517a6677ad6177d152f6ecf" - }, - { - "sourcePath": "/items/6/content/items/10/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "d68a7f96d43935aec5025b38ac8131bfd1d3c0837ec91420c2cbdb973c9fa347" - }, - "conversion": { - "sourceId": "/items/6/content/items/10/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected.\r\nEmailEvents \r\n| where isnotempty(ThreatNames) and ThreatTypes has \"Malware\" \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , \"-\", RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| mv-expand ThreatName = split(ThreatNames, \",\") to typeof(string)\r\n| where isnotempty(ThreatName)\r\n| distinct Key, ThreatName\r\n| summarize Count = count() by ThreatName\r\n| top 15 by Count\r\n| project ['Threat Name'] = ThreatName, Count", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/6/content/items/10/content/query", - "sourceSha256": "d68a7f96d43935aec5025b38ac8131bfd1d3c0837ec91420c2cbdb973c9fa347", - "targetSha256": "d68a7f96d43935aec5025b38ac8131bfd1d3c0837ec91420c2cbdb973c9fa347" - }, - { - "sourcePath": "/items/7/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "a3b8e175fb3ff34541f46d149a29711925d5c482a9f9a14d3e5e56f0519e8faf" - }, - "conversion": { - "sourceId": "/items/7/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware' and EmailDirection == 'Inbound'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalMalwareDetections=count(), Quarantine=countif(DeliveryLocation == 'Quarantine'), Failed=countif(DeliveryLocation == 'Failed') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalMalwareDetections=coalesce(TotalMalwareDetections,0), Quarantine=coalesce(Quarantine,0), Failed=coalesce(Failed,0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/2/content/query", - "sourceSha256": "a3b8e175fb3ff34541f46d149a29711925d5c482a9f9a14d3e5e56f0519e8faf", - "targetSha256": "a3b8e175fb3ff34541f46d149a29711925d5c482a9f9a14d3e5e56f0519e8faf" - }, - { - "sourcePath": "/items/7/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "ea45ad99cb7085ff2484337c2af41b5f3afd1e84af0f00116d84c2357866a972" - }, - "conversion": { - "sourceId": "/items/7/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/4/content/query", - "sourceSha256": "ea45ad99cb7085ff2484337c2af41b5f3afd1e84af0f00116d84c2357866a972", - "targetSha256": "ea45ad99cb7085ff2484337c2af41b5f3afd1e84af0f00116d84c2357866a972" - }, - { - "sourcePath": "/items/7/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "f7b64dc5f98dfd385c0290d39bc1dfc121067b1f882585a454e846d26e593a75" - }, - "conversion": { - "sourceId": "/items/7/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Malware detections summarizing the data by various Malware detection technologies/controls in Microsoft Defender for Office 365.\r\nEmailEvents \r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod)\r\n| sort by Count desc\r\n| project ['Detection Technology'] = MalwareMethod, ['Detections'] = Count", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/5/content/query", - "sourceSha256": "f7b64dc5f98dfd385c0290d39bc1dfc121067b1f882585a454e846d26e593a75", - "targetSha256": "f7b64dc5f98dfd385c0290d39bc1dfc121067b1f882585a454e846d26e593a75" - }, - { - "sourcePath": "/items/7/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "de21119c9350ed8012e9d56b9475896ed6a277ddc4d58d82498528462c86f523" - }, - "conversion": { - "sourceId": "/items/7/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Malware detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/7/content/query", - "sourceSha256": "de21119c9350ed8012e9d56b9475896ed6a277ddc4d58d82498528462c86f523", - "targetSha256": "de21119c9350ed8012e9d56b9475896ed6a277ddc4d58d82498528462c86f523" - }, - { - "sourcePath": "/items/7/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "248b79ce9222fc7113a366302ad0ae54dbc8b1b66c1fe05c66642d477a537621" - }, - "conversion": { - "sourceId": "/items/7/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Malware detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Malware' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Malware Emails'] = count_\r\n| sort by ['Malware Emails'] desc\r\n\r\n\r\n", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/7/content/items/8/content/query", - "sourceSha256": "248b79ce9222fc7113a366302ad0ae54dbc8b1b66c1fe05c66642d477a537621", - "targetSha256": "248b79ce9222fc7113a366302ad0ae54dbc8b1b66c1fe05c66642d477a537621" - }, - { - "sourcePath": "/items/8/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "02debf99cc2c7a9ebd4aeee5dbd979ab4b7fa66aba6f9735d97d6a9b8d85eee8" - }, - "conversion": { - "sourceId": "/items/8/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total inbound emails with Malware detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(ThreatTypes has \"Malware\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| where MalwareEmailCount !=0\r\n| top 15 by MalwareEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/8/content/items/2/content/query", - "sourceSha256": "02debf99cc2c7a9ebd4aeee5dbd979ab4b7fa66aba6f9735d97d6a9b8d85eee8", - "targetSha256": "02debf99cc2c7a9ebd4aeee5dbd979ab4b7fa66aba6f9735d97d6a9b8d85eee8" - }, - { - "sourcePath": "/items/8/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "26285dadd9f5d6729ee69b02f40cae580343f7d64ba34be7561a557015bf71f7" - }, - "conversion": { - "sourceId": "/items/8/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Malware detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount = count(), MalwareEmailCount = countif(ThreatTypes has \"Malware\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(MalwareEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| where MalwareEmailCount !=0\r\n| top 15 by MalwareEmailCount\r\n| project ['Sender Domain'] = SenderFromDomain, ['Malware Emails'] = MalwareEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/8/content/items/4/content/query", - "sourceSha256": "26285dadd9f5d6729ee69b02f40cae580343f7d64ba34be7561a557015bf71f7", - "targetSha256": "26285dadd9f5d6729ee69b02f40cae580343f7d64ba34be7561a557015bf71f7" - }, - { - "sourcePath": "/items/10/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "fd37ee40dbe163b31caf52d4916ff7bb4feb10641478cd97cb31eae0f8073381" - }, - "conversion": { - "sourceId": "/items/10/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//KPI summary of inbound email phishing detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet ph = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Phish\";\r\nlet inbox = ph | where DeliveryLocation has \"Inbox\";\r\nlet phTrend = toscalar(ph | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(ph | summarize count()), Details = \"Phish Emails\", Ord = 1, Trend = phTrend),\r\n(print Count = toscalar(ph | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = phTrend),\r\n(print Count = toscalar(ph | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = phTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/10/content/query", - "sourceSha256": "fd37ee40dbe163b31caf52d4916ff7bb4feb10641478cd97cb31eae0f8073381", - "targetSha256": "fd37ee40dbe163b31caf52d4916ff7bb4feb10641478cd97cb31eae0f8073381" - }, - { - "sourcePath": "/items/11/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "22eeb06bdd1b73c37db5b37e411b66901b8c19dabd2331ad63989fc967dbded0" - }, - "conversion": { - "sourceId": "/items/11/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish detections over time summarizing the data daily.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\"\r\n| summarize PhishDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, PhishDetections = coalesce(PhishDetections, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/11/content/items/2/content/query", - "sourceSha256": "22eeb06bdd1b73c37db5b37e411b66901b8c19dabd2331ad63989fc967dbded0", - "targetSha256": "22eeb06bdd1b73c37db5b37e411b66901b8c19dabd2331ad63989fc967dbded0" - }, - { - "sourcePath": "/items/11/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "e2139803441267d6d5a75748527dae86ec2356277870279716138ce6249f943b" - }, - "conversion": { - "sourceId": "/items/11/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish detections over time summarizing the data daily by Phish detection technologies/controls used for detecting unknown-unique phish.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| project Timestamp, RecipientEmailAddress, NetworkMessageId, DT=parse_json(DetectionMethods)\r\n| evaluate bag_unpack(DT)\r\n| summarize [\"File detonation\"]=countif(Phish has 'File detonation' and Phish !has 'File detonation reputation'), [\"URL detonation\"]=countif(Phish has 'URL detonation' and Phish !has 'URL detonation reputation') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"File detonation\"]=coalesce([\"File detonation\"],0), [\"URL detonation\"]=coalesce([\"URL detonation\"],0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/11/content/items/4/content/query", - "sourceSha256": "e2139803441267d6d5a75748527dae86ec2356277870279716138ce6249f943b", - "targetSha256": "e2139803441267d6d5a75748527dae86ec2356277870279716138ce6249f943b" - }, - { - "sourcePath": "/items/11/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "3be6f32b1bea4e814d3af53af70937deae7fe43a38787044f0d9aaa62b82a3e8" - }, - "conversion": { - "sourceId": "/items/11/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of emails detected as Phish by LLM content analysis detection technology in Microsoft Defender for Office 365. \r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has 'Phish' and DetectionMethods contains \"LLM content analysis\"\r\n| summarize count()\r\n| sort by count_ desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/11/content/items/7/content/query", - "sourceSha256": "3be6f32b1bea4e814d3af53af70937deae7fe43a38787044f0d9aaa62b82a3e8", - "targetSha256": "3be6f32b1bea4e814d3af53af70937deae7fe43a38787044f0d9aaa62b82a3e8" - }, - { - "sourcePath": "/items/11/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "8e13aacf6471de483b3d738bc1059c5b4827ea403e259262b6b9d4d40c50575c" - }, - "conversion": { - "sourceId": "/items/11/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish detections summarizing the data by intent of the message.\r\n// Microsoft Defender for Office 365 LLM analysis is analyzing email messages to understand the intent of the messages. These threat classifications are then used in filtering decisions.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has 'Phish' and ThreatClassification has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\r\n| summarize count() by ThreatClassification\r\n| sort by count_ desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/11/content/items/8/content/query", - "sourceSha256": "8e13aacf6471de483b3d738bc1059c5b4827ea403e259262b6b9d4d40c50575c", - "targetSha256": "8e13aacf6471de483b3d738bc1059c5b4827ea403e259262b6b9d4d40c50575c" - }, - { - "sourcePath": "/items/11/content/items/10/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "05d1791b6b26ff87d2d0fcce94f77886a64e67fb5833619e961bc1fe838c7eb9" - }, - "conversion": { - "sourceId": "/items/11/content/items/10/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises Phish detections in emails summarizing by various Threat classes showing the top attacked user for each threat classification type.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\" and EmailDirection == \"Inbound\" and ThreatClassification has_any(\"Business intelligence\",\"Contact establishment\",\"Gift card\",\"Invoice\",\"Payroll\",\"PII gathering\",\"Task\")\r\n| summarize EmailCount=count() by ThreatClassification, RecipientEmailAddress\r\n| summarize Emails = arg_max(EmailCount, RecipientEmailAddress) by ThreatClassification\r\n| sort by Emails desc\r\n| project ['Threat Classification'] = ThreatClassification, ['Top Recipient'] = RecipientEmailAddress, ['Emails'] = Emails", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/11/content/items/10/content/query", - "sourceSha256": "05d1791b6b26ff87d2d0fcce94f77886a64e67fb5833619e961bc1fe838c7eb9", - "targetSha256": "05d1791b6b26ff87d2d0fcce94f77886a64e67fb5833619e961bc1fe838c7eb9" - }, - { - "sourcePath": "/items/12/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "a350de491b28676fcbbcec5c504cb3ca4a1db5ae48d8c97aa987f59490874575" - }, - "conversion": { - "sourceId": "/items/12/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish detections over time summarizing the data daily by Delivery Location.\r\n//The comment in the query excludes deliveries to the SecOps Mailboxes and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\" and EmailDirection == \"Inbound\"\r\n| summarize TotalPhishDetections=count(), Quarantine=countif(DeliveryLocation == \"Quarantine\"), Junkfolder=countif(DeliveryLocation == \"Junk folder\"), Inbox=countif(DeliveryLocation == \"Inbox/folder\"), Failed=countif(DeliveryLocation == \"Failed\"), Dropped=countif(DeliveryLocation == \"Dropped\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalPhishDetections=coalesce(TotalPhishDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/12/content/items/2/content/query", - "sourceSha256": "a350de491b28676fcbbcec5c504cb3ca4a1db5ae48d8c97aa987f59490874575", - "targetSha256": "a350de491b28676fcbbcec5c504cb3ca4a1db5ae48d8c97aa987f59490874575" - }, - { - "sourcePath": "/items/12/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "9d9d374c3e06afb3823fffd4bb0baed757cc16db6eccfa43861ceb816b1937f4" - }, - "conversion": { - "sourceId": "/items/12/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls in Microsoft Defender for Office 365.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/12/content/items/4/content/query", - "sourceSha256": "9d9d374c3e06afb3823fffd4bb0baed757cc16db6eccfa43861ceb816b1937f4", - "targetSha256": "9d9d374c3e06afb3823fffd4bb0baed757cc16db6eccfa43861ceb816b1937f4" - }, - { - "sourcePath": "/items/12/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "183eb747b5a3e5ee38cdb0646009188239f08691ecb6b880734bf1f4b43ea273" - }, - "conversion": { - "sourceId": "/items/12/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish detections summarized by individual Phish detection technology/control in Microsoft Defender for Office 365.\r\n//Each detection technology is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\n//The where clause excludes deliveries to the SecOps Mailbox and by the Phish Simulation system.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/12/content/items/5/content/query", - "sourceSha256": "183eb747b5a3e5ee38cdb0646009188239f08691ecb6b880734bf1f4b43ea273", - "targetSha256": "183eb747b5a3e5ee38cdb0646009188239f08691ecb6b880734bf1f4b43ea273" - }, - { - "sourcePath": "/items/12/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "6e4843db67a97358acb924a864ec43d2e272004210b1434b1b59eb5637bf768c" - }, - "conversion": { - "sourceId": "/items/12/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address (SenderIPv4).\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ThreatTypes has \"Phish\" and isnotempty(SenderIPv4)\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/12/content/items/7/content/query", - "sourceSha256": "6e4843db67a97358acb924a864ec43d2e272004210b1434b1b59eb5637bf768c", - "targetSha256": "6e4843db67a97358acb924a864ec43d2e272004210b1434b1b59eb5637bf768c" - }, - { - "sourcePath": "/items/12/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "e22a42e2a2616c1db95f3b9835e72d66cf7970467d685eb93f809b3dfa7ec2ff" - }, - "conversion": { - "sourceId": "/items/12/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Phish' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Phish Emails'] = count_\r\n| sort by ['Phish Emails'] desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/12/content/items/8/content/query", - "sourceSha256": "e22a42e2a2616c1db95f3b9835e72d66cf7970467d685eb93f809b3dfa7ec2ff", - "targetSha256": "e22a42e2a2616c1db95f3b9835e72d66cf7970467d685eb93f809b3dfa7ec2ff" - }, - { - "sourcePath": "/items/13/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "0812c949bb0b46ba42d3e3ec829df7f982196eca2b0229a93cfaa5be2364d28a" - }, - "conversion": { - "sourceId": "/items/13/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total inbound emails with Phish detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),PhishEmailCount = countif(ThreatTypes has \"Phish\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where PhishEmailCount !=0\r\n| top 15 by PhishEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Phish Emails'] = PhishEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/13/content/items/2/content/query", - "sourceSha256": "0812c949bb0b46ba42d3e3ec829df7f982196eca2b0229a93cfaa5be2364d28a", - "targetSha256": "0812c949bb0b46ba42d3e3ec829df7f982196eca2b0229a93cfaa5be2364d28a" - }, - { - "sourcePath": "/items/13/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "d836b1df0d0b4884a6160c9fc03c03c79bf537737fbf3f403b07c08467d4987a" - }, - "conversion": { - "sourceId": "/items/13/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain), now including the Phish confidence split (High/Normal) and the aggregated phish detection methods seen per domain. Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\n//The comment in the query excludes deliveries to the SecOps Mailbox and by the Phish Simulation system. Remove the \"//\" to apply the exclusion.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection == \"Inbound\"\r\n| extend PhishConf = tostring(parse_json(ConfidenceLevel).Phish)\r\n| extend PhishMethods = parse_json(DetectionMethods).Phish\r\n| summarize TotalEmailCount = count(),\r\n PhishEmailCount = countif(ThreatTypes has \"Phish\"),\r\n Phish_High = countif(ThreatTypes has \"Phish\" and PhishConf == \"High\"),\r\n Phish_Normal = countif(ThreatTypes has \"Phish\" and PhishConf == \"Normal\"),\r\n PhishMethodSet = make_set_if(PhishMethods, ThreatTypes has \"Phish\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(PhishEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where PhishEmailCount != 0\r\n| top 15 by PhishEmailCount\r\n| mv-apply S = PhishMethodSet on ( mv-expand m = S to typeof(string) | summarize Methods = make_set(m) )\r\n| project ['Sender Domain'] = SenderFromDomain, ['Phish Emails'] = PhishEmailCount, ['Phish (High)'] = Phish_High, ['Phish (Normal)'] = Phish_Normal, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound, ['Detection Methods'] = strcat_array(Methods, \", \")", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/13/content/items/4/content/query", - "sourceSha256": "d836b1df0d0b4884a6160c9fc03c03c79bf537737fbf3f403b07c08467d4987a", - "targetSha256": "d836b1df0d0b4884a6160c9fc03c03c79bf537737fbf3f403b07c08467d4987a" - }, - { - "sourcePath": "/items/15/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "6b196b757eb3f8aeef37ebdc74006b81a1a30b2d070a678ba80b8765f7c5143b" - }, - "conversion": { - "sourceId": "/items/15/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//KPI summary of inbound email spam detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet sp = EmailEvents | where EmailDirection == \"Inbound\" | where ThreatTypes has \"Spam\";\r\nlet junk = sp | where DeliveryLocation has \"Junk\";\r\nlet spTrend = toscalar(sp | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet junkTrend = toscalar(junk | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(sp | summarize count()), Details = \"Spam Emails\", Ord = 1, Trend = spTrend),\r\n(print Count = toscalar(sp | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = spTrend),\r\n(print Count = toscalar(sp | summarize dcount(SenderFromDomain)), Details = \"Sender Domains\", Ord = 3, Trend = spTrend),\r\n(print Count = toscalar(junk | summarize count()), Details = \"Sent to Junk\", Ord = 4, Trend = junkTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/15/content/query", - "sourceSha256": "6b196b757eb3f8aeef37ebdc74006b81a1a30b2d070a678ba80b8765f7c5143b", - "targetSha256": "6b196b757eb3f8aeef37ebdc74006b81a1a30b2d070a678ba80b8765f7c5143b" - }, - { - "sourcePath": "/items/16/content/items/1/content/items/0/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "a28e74bfbbd4ebedca74681ae5fb0ce2a86f234832b90e21cb0c4e5e7b007f65" - }, - "conversion": { - "sourceId": "/items/16/content/items/1/content/items/0/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query calculates the effectiveness of spam detections without edge data.\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n// baseQuery _FN_Admin_Submissions_SPM\r\nlet _FN_Admin_Submissions_SPM = toscalar(\r\nCloudAppEvents\r\n| where Timestamp between (minTime .. maxTime)\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\r\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\r\n| where SubmissionType in (\"0\")\r\n| summarize count()\r\n);\r\n// baseQuery _FN_ZAP_Successful_Spam\r\nlet _FN_ZAP_Successful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult == \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\r\n);\r\n// baseQuery _FN_ZAP_Unsuccessful_Spam\r\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult != \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\r\n);\r\n// baseQuery _SPAM_ZAP_FP\r\nlet _SPAM_ZAP_FP = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and Action has_any (\"Redelivery\",\"Reprocessed\") and Timestamp between (minTime .. maxTime)\r\n| join kind=leftsemi (\r\n EmailEvents\r\n | where Timestamp between (minTime ..maxTime )\r\n | where ThreatTypes contains \"Spam\"\r\n | project NetworkMessageId, ThreatTypes)\r\n on NetworkMessageId\r\n| summarize count()\r\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\r\n);\r\n// baseQuery _Spam_Mailflow\r\nlet _Spam_Mailflow = toscalar(\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and ThreatTypes == \"Spam\" and Timestamp between (minTime .. maxTime)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count()\r\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\r\n);\r\nprint\r\nEffectiveness_PostDelivery = abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))/(toreal(toscalar(_Spam_Mailflow))+toreal(toscalar(_FN_ZAP_Successful_Spam))+toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))+toreal(toscalar(_FN_Admin_Submissions_SPM))-toreal(toscalar(_SPAM_ZAP_FP)))*100-100),2))", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/16/content/items/1/content/items/0/content/query", - "sourceSha256": "a28e74bfbbd4ebedca74681ae5fb0ce2a86f234832b90e21cb0c4e5e7b007f65", - "targetSha256": "a28e74bfbbd4ebedca74681ae5fb0ce2a86f234832b90e21cb0c4e5e7b007f65" - }, - { - "sourcePath": "/items/16/content/items/1/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "238ae09c435a5406518596dc18426054e6d6dfc9d7c4df50704b41b1780cd2bf" - }, - "conversion": { - "sourceId": "/items/16/content/items/1/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\n// baseQuery _FN_Admin_Submissions_SPM\r\nlet _FN_Admin_Submissions_SPM = toscalar(\r\nCloudAppEvents\r\n| where Timestamp between (minTime .. maxTime)\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType)\r\n| extend NetworkMessageId = tostring((parse_json(RawEventData)).ObjectId)\r\n| where SubmissionType in (\"0\")\r\n| summarize count()\r\n);\r\n// baseQuery _FN_ZAP_Successful_Spam\r\nlet _FN_ZAP_Successful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult == \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n //Take all our Spam ZAP, and count how many messages we missed and successfully cleaned up.\r\n);\r\n// baseQuery _FN_ZAP_Unsuccessful_Spam\r\nlet _FN_ZAP_Unsuccessful_Spam = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and ActionType == \"Spam ZAP\" and ActionResult != \"Success\" and Timestamp between (minTime .. maxTime)\r\n| summarize count()\r\n//Take all our Spam ZAP, and count how many messages we failed to clean up due to error or users/admins/API vendors getting to the message first.\r\n);\r\n// baseQuery _SPAM_ZAP_FP\r\nlet _SPAM_ZAP_FP = toscalar(\r\nEmailPostDeliveryEvents\r\n| where ActionTrigger == \"SpecialAction\" and Action has_any (\"Redelivery\",\"Reprocessed\") and Timestamp between (minTime .. maxTime)\r\n| join kind=leftsemi (\r\n EmailEvents\r\n | where Timestamp between (minTime ..maxTime )\r\n | where ThreatTypes contains \"Spam\"\r\n | project NetworkMessageId, ThreatTypes)\r\n on NetworkMessageId\r\n| summarize count()\r\n// count all the FPs which were originally Spam, and when we TT'd them were not so we can subtract that from our mailfow catch, and therefore the total true bad.\r\n);\r\n// baseQuery _Spam_Mailflow\r\nlet _Spam_Mailflow = toscalar(\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and ThreatTypes == \"Spam\" and Timestamp between (minTime .. maxTime)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count()\r\n// Get all the mailflow detected as SPM, then count all the NMIDs (not distinct)\r\n);\r\nprint StatisticName=\"Spam Mailflow Minus FPs\", Value=toreal((toscalar(_Spam_Mailflow)) - toreal(toscalar(_SPAM_ZAP_FP)))\r\n| union (print StatisticName=\"Spam Admin FNs Submitted\", Value=toreal(toscalar(_FN_Admin_Submissions_SPM)))\r\n| union (print StatisticName=\"Spam FPs Reverse Zapped\", Value=toreal(toscalar(_SPAM_ZAP_FP)))\r\n| union (print StatisticName=\"Spam Zapped Successfully\", Value=toreal(toscalar(_FN_ZAP_Successful_Spam)))\r\n| union (print StatisticName=\"Spam NotZapped\", Value=toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)))\r\n| union (print StatisticName=\"Spam Effectiveness Post Delivery %\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2)))\r\n| union (print StatisticName=\"Spam Effectiveness Pre-Delivery %\", Value=abs(round(((toreal(toscalar(_FN_Admin_Submissions_SPM)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + (toscalar(_FN_ZAP_Successful_Spam))) / (toreal(toscalar(_Spam_Mailflow)) + toreal(toscalar(_FN_ZAP_Successful_Spam)) + toreal(toscalar(_FN_ZAP_Unsuccessful_Spam)) + toreal(toscalar(_FN_Admin_Submissions_SPM)) - toreal(toscalar(_SPAM_ZAP_FP)))) * 100 - 100, 2 )))\r\n| project ['Statistic'] = StatisticName, Value", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/16/content/items/1/content/items/1/content/query", - "sourceSha256": "238ae09c435a5406518596dc18426054e6d6dfc9d7c4df50704b41b1780cd2bf", - "targetSha256": "238ae09c435a5406518596dc18426054e6d6dfc9d7c4df50704b41b1780cd2bf" - }, - { - "sourcePath": "/items/16/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "fe5a749c7e0a653d852395156da4cd7e7ce7ff1762e665d4cd777999277abeea" - }, - "conversion": { - "sourceId": "/items/16/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Spam detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Spam\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, SpamDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/16/content/items/3/content/query", - "sourceSha256": "fe5a749c7e0a653d852395156da4cd7e7ce7ff1762e665d4cd777999277abeea", - "targetSha256": "fe5a749c7e0a653d852395156da4cd7e7ce7ff1762e665d4cd777999277abeea" - }, - { - "sourcePath": "/items/17/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "c0470a13c60b55b6e4ce12d21e152594a1a40feb0185e87be6b806d9bb639e2b" - }, - "conversion": { - "sourceId": "/items/17/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Spam detections over time summarizing the data daily by Delivery Location.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spam\" and EmailDirection == \"Inbound\"\r\n| summarize TotalSpamDetections=count(), Quarantine=countif(DeliveryLocation == \"Quarantine\"), Junkfolder=countif(DeliveryLocation == \"Junk folder\"), Inbox=countif(DeliveryLocation == \"Inbox/folder\"), Failed=countif(DeliveryLocation == \"Failed\"), Dropped=countif(DeliveryLocation == \"Dropped\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, TotalSpamDetections=coalesce(TotalSpamDetections,0), Quarantine=coalesce(Quarantine,0), Junkfolder=coalesce(Junkfolder,0), Inbox=coalesce(Inbox,0), Failed=coalesce(Failed,0), Dropped=coalesce(Dropped,0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/17/content/items/2/content/query", - "sourceSha256": "c0470a13c60b55b6e4ce12d21e152594a1a40feb0185e87be6b806d9bb639e2b", - "targetSha256": "c0470a13c60b55b6e4ce12d21e152594a1a40feb0185e87be6b806d9bb639e2b" - }, - { - "sourcePath": "/items/17/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "01dd1fe6bc4a32ab61b2b9850669c2026f1acca5ebbbdb9b26ba708a81f1af1e" - }, - "conversion": { - "sourceId": "/items/17/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Spam detections over time summarizing the data daily by various Spam Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where DetectionMethods has \"Spam\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/17/content/items/4/content/query", - "sourceSha256": "01dd1fe6bc4a32ab61b2b9850669c2026f1acca5ebbbdb9b26ba708a81f1af1e", - "targetSha256": "01dd1fe6bc4a32ab61b2b9850669c2026f1acca5ebbbdb9b26ba708a81f1af1e" - }, - { - "sourcePath": "/items/17/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "084647209d37f116cf1a204d17143575d79adf54e3f8450baca8fd358dc9b509" - }, - "conversion": { - "sourceId": "/items/17/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Spam detections summarized by individual Spam detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Spam (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spam\"\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/17/content/items/5/content/query", - "sourceSha256": "084647209d37f116cf1a204d17143575d79adf54e3f8450baca8fd358dc9b509", - "targetSha256": "084647209d37f116cf1a204d17143575d79adf54e3f8450baca8fd358dc9b509" - }, - { - "sourcePath": "/items/17/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "a7de4ffc8f7eb27db97b364965b34b9ec8a07e8fcfe5d069b5bf7a8d34a22b4d" - }, - "conversion": { - "sourceId": "/items/17/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Spam detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where ThreatTypes has \"Spam\" and isnotempty(SenderIPv4)\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_ ", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/17/content/items/7/content/query", - "sourceSha256": "a7de4ffc8f7eb27db97b364965b34b9ec8a07e8fcfe5d069b5bf7a8d34a22b4d", - "targetSha256": "a7de4ffc8f7eb27db97b364965b34b9ec8a07e8fcfe5d069b5bf7a8d34a22b4d" - }, - { - "sourcePath": "/items/17/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "abe3f3e14822dc6298e344ededd703ec24e2997b07a30f795a42767adc476f0b" - }, - "conversion": { - "sourceId": "/items/17/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Spam detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where ThreatTypes has 'Spam' and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Spam Emails'] = count_\r\n| sort by ['Spam Emails'] desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/17/content/items/8/content/query", - "sourceSha256": "abe3f3e14822dc6298e344ededd703ec24e2997b07a30f795a42767adc476f0b", - "targetSha256": "abe3f3e14822dc6298e344ededd703ec24e2997b07a30f795a42767adc476f0b" - }, - { - "sourcePath": "/items/17/content/items/10/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "8a63fd07272a42368011810f1c3cb00be81d94a86868e94a0fc0747bda98aa3f" - }, - "conversion": { - "sourceId": "/items/17/content/items/10/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels to understand how many messages are detected with each Bulk Complaint level.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isnotnull(BulkComplaintLevel)\r\n| summarize count() by BulkComplaintLevel\r\n| sort by BulkComplaintLevel desc\r\n| project ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/17/content/items/10/content/query", - "sourceSha256": "8a63fd07272a42368011810f1c3cb00be81d94a86868e94a0fc0747bda98aa3f", - "targetSha256": "8a63fd07272a42368011810f1c3cb00be81d94a86868e94a0fc0747bda98aa3f" - }, - { - "sourcePath": "/items/17/content/items/11/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "51704280a4a6d8449a6de591364095c8ac023580aad92e90748958c6811c2326" - }, - "conversion": { - "sourceId": "/items/17/content/items/11/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total inbound emails which has any Bulk complaint level. It is summarizing the data by the various Bulk Complaint levels and SenderFromDomain of the email sender. It provides insights how many messages are detected with each Bulk Complaint level for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\" and isnotnull(BulkComplaintLevel)\r\n| summarize count() by BulkComplaintLevel, SenderFromDomain\r\n| top 10 by count_ desc\r\n| project ['Sender Domain'] = SenderFromDomain, ['Bulk Complaint Level'] = BulkComplaintLevel, Emails=count_", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/17/content/items/11/content/query", - "sourceSha256": "51704280a4a6d8449a6de591364095c8ac023580aad92e90748958c6811c2326", - "targetSha256": "51704280a4a6d8449a6de591364095c8ac023580aad92e90748958c6811c2326" - }, - { - "sourcePath": "/items/18/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "78adf2f996597251405ce011ccd04e54e1dda00c5b7d4912c5e05cd125f7609d" - }, - "conversion": { - "sourceId": "/items/18/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 recipient email address (RecipientEmailAddress).\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection ==\"Inbound\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),SpamEmailCount = countif(ThreatTypes has \"Spam\") by RecipientEmailAddress\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount)* 100, 2))\r\n| where SpamEmailCount !=0\r\n| top 15 by SpamEmailCount\r\n| project ['Recipient'] = RecipientEmailAddress, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/18/content/items/2/content/query", - "sourceSha256": "78adf2f996597251405ce011ccd04e54e1dda00c5b7d4912c5e05cd125f7609d", - "targetSha256": "78adf2f996597251405ce011ccd04e54e1dda00c5b7d4912c5e05cd125f7609d" - }, - { - "sourcePath": "/items/18/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "bc7b742b68f85605fbb44ce79e3a721dbf9258eb6bf68430e710e92e5f704da3" - }, - "conversion": { - "sourceId": "/items/18/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total inbound emails with Spam detections summarizing the data by the top 15 email sender P2 domain (SenderFromDomain). Adding additional insights for total inbound emails and bad traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| where EmailDirection == \"Inbound\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount = count(),\r\n SpamEmailCount = countif(ThreatTypes has \"Spam\") by SenderFromDomain\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(SpamEmailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpamEmailCount !=0\r\n| top 15 by SpamEmailCount\r\n| project ['Sender Domain'] = SenderFromDomain, ['Spam Emails'] = SpamEmailCount, ['Total Inbound'] = TotalEmailCount, ['Bad Traffic %'] = Bad_Traffic_Percentage_Inbound", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/18/content/items/4/content/query", - "sourceSha256": "bc7b742b68f85605fbb44ce79e3a721dbf9258eb6bf68430e710e92e5f704da3", - "targetSha256": "bc7b742b68f85605fbb44ce79e3a721dbf9258eb6bf68430e710e92e5f704da3" - }, - { - "sourcePath": "/items/20/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "c4f105af76862707cad18ad90f0cc5ca9122667bdb580b6150b0a122ab85fb8b" - }, - "conversion": { - "sourceId": "/items/20/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//KPI summary of inbound email impersonation and spoof (BEC) detections for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet bec = EmailEvents | where EmailDirection == \"Inbound\" | where DetectionMethods has \"Impersonation\" or DetectionMethods has \"Spoof\";\r\nlet inbox = bec | where DeliveryLocation has \"Inbox\";\r\nlet becTrend = toscalar(bec | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet inboxTrend = toscalar(inbox | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(bec | summarize count()), Details = \"Impersonation / Spoof Emails\", Ord = 1, Trend = becTrend),\r\n(print Count = toscalar(bec | summarize dcount(RecipientEmailAddress)), Details = \"Users Targeted\", Ord = 2, Trend = becTrend),\r\n(print Count = toscalar(bec | summarize dcount(SenderFromDomain)), Details = \"Spoofed Sender Domains\", Ord = 3, Trend = becTrend),\r\n(print Count = toscalar(inbox | summarize count()), Details = \"Delivered to Inbox\", Ord = 4, Trend = inboxTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/20/content/query", - "sourceSha256": "c4f105af76862707cad18ad90f0cc5ca9122667bdb580b6150b0a122ab85fb8b", - "targetSha256": "c4f105af76862707cad18ad90f0cc5ca9122667bdb580b6150b0a122ab85fb8b" - }, - { - "sourcePath": "/items/21/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "19c8169c55a32ba881163427e6775f54646e428c4c7d3f183237dfc4f5b80122" - }, - "conversion": { - "sourceId": "/items/21/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has 'Impersonation'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ImpersonationDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/21/content/items/2/content/query", - "sourceSha256": "19c8169c55a32ba881163427e6775f54646e428c4c7d3f183237dfc4f5b80122", - "targetSha256": "19c8169c55a32ba881163427e6775f54646e428c4c7d3f183237dfc4f5b80122" - }, - { - "sourcePath": "/items/21/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "0a348831425415001b2848be6a4ab1393cd02e0d34042fca75837862b9f42dd8" - }, - "conversion": { - "sourceId": "/items/21/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections over time summarizing the data daily by various Impersonation Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Impersonation\"\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/21/content/items/4/content/query", - "sourceSha256": "0a348831425415001b2848be6a4ab1393cd02e0d34042fca75837862b9f42dd8", - "targetSha256": "0a348831425415001b2848be6a4ab1393cd02e0d34042fca75837862b9f42dd8" - }, - { - "sourcePath": "/items/21/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "222ae168c6cb938f7b93b895788a390fb029a32e1664cb2789bc5fab6aeb11b5" - }, - "conversion": { - "sourceId": "/items/21/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish - Business Email Compromise (BEC) - Impersonation detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Impersonation\"\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/21/content/items/5/content/query", - "sourceSha256": "222ae168c6cb938f7b93b895788a390fb029a32e1664cb2789bc5fab6aeb11b5", - "targetSha256": "222ae168c6cb938f7b93b895788a390fb029a32e1664cb2789bc5fab6aeb11b5" - }, - { - "sourcePath": "/items/21/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "7230d3dec852957a1977bc5cbd58bddca882e80fe7bdbecaeed68093d065df5e" - }, - "conversion": { - "sourceId": "/items/21/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Impersonation detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Impersonation\" and isnotempty(SenderIPv4)\r\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \r\n| summarize count()by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_ ", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/21/content/items/7/content/query", - "sourceSha256": "7230d3dec852957a1977bc5cbd58bddca882e80fe7bdbecaeed68093d065df5e", - "targetSha256": "7230d3dec852957a1977bc5cbd58bddca882e80fe7bdbecaeed68093d065df5e" - }, - { - "sourcePath": "/items/21/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "5b2791d69e5d49a1e94edfbf28e6131f53002bb9255f81ba6d9f55db046704d8" - }, - "conversion": { - "sourceId": "/items/21/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where DetectionMethods has \"Impersonation\" and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Impersonation Emails'] = count_\r\n| sort by ['Impersonation Emails'] desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/21/content/items/8/content/query", - "sourceSha256": "5b2791d69e5d49a1e94edfbf28e6131f53002bb9255f81ba6d9f55db046704d8", - "targetSha256": "5b2791d69e5d49a1e94edfbf28e6131f53002bb9255f81ba6d9f55db046704d8" - }, - { - "sourcePath": "/items/21/content/items/10/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "83698c8e41887bef4abd2fe97ab3f556741c929628fb05d4d18e88a223c9df41" - }, - "conversion": { - "sourceId": "/items/21/content/items/10/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has 'Spoof'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, SpoofDetections = coalesce(Count, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/21/content/items/10/content/query", - "sourceSha256": "83698c8e41887bef4abd2fe97ab3f556741c929628fb05d4d18e88a223c9df41", - "targetSha256": "83698c8e41887bef4abd2fe97ab3f556741c929628fb05d4d18e88a223c9df41" - }, - { - "sourcePath": "/items/21/content/items/12/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "37a68140432a447f5c7af8dbdfda9bca62395fb84ec1e8a0ae8f005d73404490" - }, - "conversion": { - "sourceId": "/items/21/content/items/12/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections over time summarizing the data daily by various Spoof Detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Spoof\"\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/21/content/items/12/content/query", - "sourceSha256": "37a68140432a447f5c7af8dbdfda9bca62395fb84ec1e8a0ae8f005d73404490", - "targetSha256": "37a68140432a447f5c7af8dbdfda9bca62395fb84ec1e8a0ae8f005d73404490" - }, - { - "sourcePath": "/items/21/content/items/13/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "4c9ff00bc3a99712b53534750ac48fda121b96ced9fbcdfaaa69da335fc6d14a" - }, - "conversion": { - "sourceId": "/items/21/content/items/13/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish - Business Email Compromise (BEC) - Spoof detections summarized by individual detection technology/control in Microsoft Defender for Office 365.\r\n//Each technique is counted individually via mv-expand over DetectionMethods.Phish (matching the sibling trend line chart), so a message flagged by multiple techniques counts once per technique.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Phish\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where Details has \"Spoof\"\r\n| summarize Count = count() by Details\r\n| sort by Count desc\r\n| project ['Detection Technology'] = Details, ['Detections'] = Count", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/21/content/items/13/content/query", - "sourceSha256": "4c9ff00bc3a99712b53534750ac48fda121b96ced9fbcdfaaa69da335fc6d14a", - "targetSha256": "4c9ff00bc3a99712b53534750ac48fda121b96ced9fbcdfaaa69da335fc6d14a" - }, - { - "sourcePath": "/items/21/content/items/15/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "6d4e09079b6dccedc1d063269c18eeb986714a2bc0117b85d554b879415d29d3" - }, - "conversion": { - "sourceId": "/items/21/content/items/15/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish – Business Email Compromise (BEC) – Spoof detections summarizing the data by email sender IP address (SenderIPv4).\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where DetectionMethods has \"Spoof\" and isnotempty(SenderIPv4)\r\n//| project Timestamp, EmailDirection, SenderFromAddress, AdditionalFields, SenderIPv4 \r\n| summarize count()by SenderIPv4\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Latitude = tostring(GeoInfo.latitude), Longitude = tostring(GeoInfo.longitude)\r\n| project SenderIPv4, Latitude, Longitude, count_ ", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/21/content/items/15/content/query", - "sourceSha256": "6d4e09079b6dccedc1d063269c18eeb986714a2bc0117b85d554b879415d29d3", - "targetSha256": "6d4e09079b6dccedc1d063269c18eeb986714a2bc0117b85d554b879415d29d3" - }, - { - "sourcePath": "/items/21/content/items/16/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "c1be2cd17e75ae46d3684fbb36345ffe412cf242cd59f72b21e72389fbf833ba" - }, - "conversion": { - "sourceId": "/items/21/content/items/16/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish detections summarizing the data by email sender IP address and IP address country information (SenderIPv4).\r\nEmailEvents \r\n| where DetectionMethods has \"Spoof\" and isnotempty(SenderIPv4)\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend GeoInfo = geo_info_from_ip_address(SenderIPv4)\r\n| extend Country = tostring(GeoInfo.country)\r\n| summarize count() by Country\r\n| project Country, ['Spoof Emails'] = count_\r\n| sort by ['Spoof Emails'] desc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/21/content/items/16/content/query", - "sourceSha256": "c1be2cd17e75ae46d3684fbb36345ffe412cf242cd59f72b21e72389fbf833ba", - "targetSha256": "c1be2cd17e75ae46d3684fbb36345ffe412cf242cd59f72b21e72389fbf833ba" - }, - { - "sourcePath": "/items/21/content/items/18/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "8de5a8ad15b74c19ef2783d043cf7c817e8c56340e9adbcf8abe387915d09ae6" - }, - "conversion": { - "sourceId": "/items/21/content/items/18/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises top outbound recipient domains by outbound email volume and shows total number of inbound emails with Threats from the same domains (as inbound senders) \r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Outbound\"\r\n| project RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| summarize count() by RecipientDomain\r\n| project OutboundCount=count_, RecipientDomain, SenderFromDomain=RecipientDomain\r\n| join (EmailEvents | where EmailDirection == \"Inbound\" and isempty(ThreatTypes)==false) on SenderFromDomain\r\n| summarize max(OutboundCount),count() by SenderFromDomain\r\n| project SenderFromDomain, OutboundEmails=max_OutboundCount, IncomingEmailsWithThreats=count_\r\n| extend Bad_Traffic_Percentage = todouble(round(IncomingEmailsWithThreats / todouble(OutboundEmails) * 100, 2))\r\n| top 15 by OutboundEmails\r\n| project ['Sender Domain'] = SenderFromDomain, ['Outbound Emails'] = OutboundEmails, ['Inbound w/ Threats'] = IncomingEmailsWithThreats, ['Bad Traffic %'] = Bad_Traffic_Percentage", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/21/content/items/18/content/query", - "sourceSha256": "8de5a8ad15b74c19ef2783d043cf7c817e8c56340e9adbcf8abe387915d09ae6", - "targetSha256": "8de5a8ad15b74c19ef2783d043cf7c817e8c56340e9adbcf8abe387915d09ae6" - }, - { - "sourcePath": "/items/21/content/items/20/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "c0d35624bc2b22f0fae34301c14aa1cddba46b1c14c9ba76ae471c7de9f59f39" - }, - "conversion": { - "sourceId": "/items/21/content/items/20/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Top recipients targeted by impersonation / BEC, with distinct senders, spoofed domains and how many landed in the inbox.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| where DetectionMethods has \"Impersonation\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize ImpersonationEmails = count(),\r\n DistinctSenders = dcount(SenderFromAddress),\r\n TopSpoofedDomains = make_set(SenderFromDomain, 5),\r\n DeliveredToInbox = countif(DeliveryLocation has \"Inbox\")\r\n by RecipientEmailAddress\r\n| top 20 by ImpersonationEmails\r\n| project ['Recipient'] = RecipientEmailAddress, ['Impersonation Emails'] = ImpersonationEmails, ['Distinct Senders'] = DistinctSenders, ['Top Spoofed Domains'] = strcat_array(TopSpoofedDomains, \", \"), ['Delivered to Inbox'] = DeliveredToInbox", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/21/content/items/20/content/query", - "sourceSha256": "c0d35624bc2b22f0fae34301c14aa1cddba46b1c14c9ba76ae471c7de9f59f39", - "targetSha256": "c0d35624bc2b22f0fae34301c14aa1cddba46b1c14c9ba76ae471c7de9f59f39" - }, - { - "sourcePath": "/items/22/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "58b9016775f366c2cf992c083592ff71ae2135da153677b3f824c46f7a957ae1" - }, - "conversion": { - "sourceId": "/items/22/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Spoof- DMARC fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend DMARCFail = (tostring(parse_json(AuthenticationDetails).DMARC) == \"fail\") \r\n| summarize DMARCFail = sum(DMARCFail) by bin (Timestamp,{Granularity})", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/22/content/items/2/content/query", - "sourceSha256": "58b9016775f366c2cf992c083592ff71ae2135da153677b3f824c46f7a957ae1", - "targetSha256": "58b9016775f366c2cf992c083592ff71ae2135da153677b3f824c46f7a957ae1" - }, - { - "sourcePath": "/items/22/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "a28a9af539c2397ac3fd1c84ef7c2783d5a479e471df73be7ca43caace84e681" - }, - "conversion": { - "sourceId": "/items/22/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Spoof- DKIM fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend DKIMFail = (tostring(parse_json(AuthenticationDetails).DKIM) == \"fail\") \r\n| summarize DKIMFail = sum(DKIMFail) by bin (Timestamp,{Granularity})", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/22/content/items/3/content/query", - "sourceSha256": "a28a9af539c2397ac3fd1c84ef7c2783d5a479e471df73be7ca43caace84e681", - "targetSha256": "a28a9af539c2397ac3fd1c84ef7c2783d5a479e471df73be7ca43caace84e681" - }, - { - "sourcePath": "/items/22/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "41d09c9e789532d07dc69ecc411bc68133aafd96989cf4e02eeb42b33d2c8d01" - }, - "conversion": { - "sourceId": "/items/22/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Spoof- SPF fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend SPFFail = (tostring(parse_json(AuthenticationDetails).SPF) == \"fail\") \r\n| summarize SPFFail = sum(SPFFail) by bin (Timestamp,{Granularity})", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/22/content/items/4/content/query", - "sourceSha256": "41d09c9e789532d07dc69ecc411bc68133aafd96989cf4e02eeb42b33d2c8d01", - "targetSha256": "41d09c9e789532d07dc69ecc411bc68133aafd96989cf4e02eeb42b33d2c8d01" - }, - { - "sourcePath": "/items/22/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "ea61c1a26e95808521fbe8cbdbdcf1d04ea9085ee24a39412cb680dc728a73c3" - }, - "conversion": { - "sourceId": "/items/22/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Spoof- Composite Authentication fails summarizing the data daily.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend CompAuthFail = (tostring(parse_json(AuthenticationDetails).CompAuth) == \"fail\") \r\n| summarize CompAuthFail = sum(CompAuthFail) by bin (Timestamp,{Granularity})", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/22/content/items/5/content/query", - "sourceSha256": "ea61c1a26e95808521fbe8cbdbdcf1d04ea9085ee24a39412cb680dc728a73c3", - "targetSha256": "ea61c1a26e95808521fbe8cbdbdcf1d04ea9085ee24a39412cb680dc728a73c3" - }, - { - "sourcePath": "/items/22/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "c77a0ff030a3dd2b738f7fd66ac24d6eabd640f0edcfad21a2e4de669dff53f7" - }, - "conversion": { - "sourceId": "/items/22/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Spoof-DMARC fails detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and DMARC fail traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n DMARCFailCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof DMARC\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend DMARCFail_Traffic_Percentage = todouble(round(DMARCFailCount / todouble(TotalEmailCount) * 100, 2))\r\n| where DMARCFailCount !=0\r\n| top 10 by DMARCFailCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['DMARC Failures'] = DMARCFailCount, ['Total Inbound'] = TotalEmailCount, ['DMARC Fail %'] = DMARCFail_Traffic_Percentage", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/22/content/items/7/content/query", - "sourceSha256": "c77a0ff030a3dd2b738f7fd66ac24d6eabd640f0edcfad21a2e4de669dff53f7", - "targetSha256": "c77a0ff030a3dd2b738f7fd66ac24d6eabd640f0edcfad21a2e4de669dff53f7" - }, - { - "sourcePath": "/items/22/content/items/9/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "47768c7215fdf1bf634a0a9b52fe50f8e37e04820aed240d40b792a2e944cd9f" - }, - "conversion": { - "sourceId": "/items/22/content/items/9/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish-Spoof-external domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof external domain detection traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n SpoofExternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof external domain\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend SpoofExternal_Traffic_Percentage = todouble(round(SpoofExternalCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpoofExternalCount !=0\r\n| top 10 by SpoofExternalCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof External'] = SpoofExternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof External %'] = SpoofExternal_Traffic_Percentage", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/22/content/items/9/content/query", - "sourceSha256": "47768c7215fdf1bf634a0a9b52fe50f8e37e04820aed240d40b792a2e944cd9f", - "targetSha256": "47768c7215fdf1bf634a0a9b52fe50f8e37e04820aed240d40b792a2e944cd9f" - }, - { - "sourcePath": "/items/22/content/items/11/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "7dce088cd958bf29049a469802daad4299c5cba83a4f3703a93131ee18525824" - }, - "conversion": { - "sourceId": "/items/22/content/items/11/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phish-Spoof-internal domain detections summarizing the data by the top 10 email sender P2 domain (SenderFromDomain) and sender P1 domain (SenderMailFromDomain). Adding additional insights for total inbound emails and Spoof internal domain detection traffic percentage for each sender domain.\r\nEmailEvents\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalEmailCount = count(),\r\n SpoofInternalCount = countif(set_has_element(parse_json(DetectionMethods).Phish, \"Spoof intra-org\")) by P1Sender=SenderMailFromDomain, P2Sender=SenderFromDomain\r\n| extend SpoofInternal_Traffic_Percentage = todouble(round(SpoofInternalCount / todouble(TotalEmailCount) * 100, 2))\r\n| where SpoofInternalCount !=0\r\n| top 10 by SpoofInternalCount\r\n| project ['P1 Sender'] = P1Sender, ['P2 Sender'] = P2Sender, ['Spoof Internal'] = SpoofInternalCount, ['Total Inbound'] = TotalEmailCount, ['Spoof Internal %'] = SpoofInternal_Traffic_Percentage", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/22/content/items/11/content/query", - "sourceSha256": "7dce088cd958bf29049a469802daad4299c5cba83a4f3703a93131ee18525824", - "targetSha256": "7dce088cd958bf29049a469802daad4299c5cba83a4f3703a93131ee18525824" - }, - { - "sourcePath": "/items/23/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "c5790761884246424b5b0bb4f99d1c87fc14a5ba40d87397d14df2e97c4c963c" - }, - "conversion": { - "sourceId": "/items/23/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists external email senders seen for the first time in the selected period (most recent first), surfacing new/first-contact senders. In tenants with longer history this highlights genuinely new relationships - a common precursor to BEC and supply-chain attacks.\r\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"fabrikam.com\"]);\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend SenderDomain = tostring(split(SenderFromAddress, \"@\")[1])\r\n| where isnotempty(SenderFromAddress)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| summarize FirstSeen=min(Timestamp), Messages=count(), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderFromAddress, SenderDomain\r\n| top 20 by FirstSeen desc\r\n| project ['Sender']=SenderFromAddress, ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, ['Threat Messages']=ThreatMessages", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/23/content/items/2/content/query", - "sourceSha256": "c5790761884246424b5b0bb4f99d1c87fc14a5ba40d87397d14df2e97c4c963c", - "targetSha256": "c5790761884246424b5b0bb4f99d1c87fc14a5ba40d87397d14df2e97c4c963c" - }, - { - "sourcePath": "/items/23/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "3b57a1805ed80603ed532a37c949b325e6089df1020df9f12dc3173efc2de493" - }, - "conversion": { - "sourceId": "/items/23/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists external sender domains seen for the first time in the selected period that already carried threats, ranked by most-recently first seen. A brand-new domain sending threats to your users is a strong early-warning signal for phishing and BEC.\r\n// TIP: to hide your own accepted domains, uncomment the ExcludeDomains line and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"fabrikam.com\"]);\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| extend SenderDomain = tostring(split(SenderFromAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Messages=count(), Senders=dcount(SenderFromAddress), Recipients=dcount(RecipientEmailAddress), ThreatMessages=countif(isnotempty(ThreatTypes)) by SenderDomain\r\n| where ThreatMessages > 0\r\n| top 20 by FirstSeen desc\r\n| project ['Sender Domain']=SenderDomain, ['First Seen']=FirstSeen, Messages, Senders, Recipients, ['Threat Messages']=ThreatMessages, ['Last Seen']=LastSeen", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/23/content/items/4/content/query", - "sourceSha256": "3b57a1805ed80603ed532a37c949b325e6089df1020df9f12dc3173efc2de493", - "targetSha256": "3b57a1805ed80603ed532a37c949b325e6089df1020df9f12dc3173efc2de493" - }, - { - "sourcePath": "/items/25/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "b4352c617373ee0d8c94c692bce5613e67cb7612fa7922e78ac78634aa714714" - }, - "conversion": { - "sourceId": "/items/25/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//KPI summary of URL threat protection (Safe Links clicks and URLs seen in email) for the selected period, with a per-period Trend series feeding each tile sparkline.\r\nlet gran = {Granularity};\r\nlet clicks = UrlClickEvents;\r\nlet blocked = clicks | where ActionType in (\"ClickBlocked\",\"ClickBlockedByTenantPolicy\");\r\nlet allowed = clicks | where ActionType == \"ClickAllowed\";\r\nlet blockedTrend = toscalar(blocked | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet allowedTrend = toscalar(allowed | make-series Trend = count() default = 0 on Timestamp step gran | project Trend);\r\nlet usersTrend = toscalar(clicks | make-series Trend = dcount(AccountUpn) default = 0 on Timestamp step gran | project Trend);\r\nlet urlsTrend = toscalar(EmailUrlInfo | make-series Trend = dcount(Url) default = 0 on Timestamp step gran | project Trend);\r\nunion\r\n(print Count = toscalar(blocked | summarize count()), Details = \"Malicious Clicks Blocked\", Ord = 1, Trend = blockedTrend),\r\n(print Count = toscalar(allowed | summarize count()), Details = \"Clicks Allowed Through\", Ord = 2, Trend = allowedTrend),\r\n(print Count = toscalar(clicks | summarize dcount(AccountUpn)), Details = \"Users Clicking Links\", Ord = 3, Trend = usersTrend),\r\n(print Count = toscalar(EmailUrlInfo | summarize dcount(Url)), Details = \"Distinct URLs in Email\", Ord = 4, Trend = urlsTrend)\r\n| sort by Ord asc\r\n| project Count, Details, Trend", - "resolvedTables": [ - "EmailUrlInfo", - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailUrlInfo", - "ahTable": "EmailUrlInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 7, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/25/content/query", - "sourceSha256": "b4352c617373ee0d8c94c692bce5613e67cb7612fa7922e78ac78634aa714714", - "targetSha256": "b4352c617373ee0d8c94c692bce5613e67cb7612fa7922e78ac78634aa714714" - }, - { - "sourcePath": "/items/26/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "9daabfabfcb9f9a343c05b6a9a3628be01341908ce2121be22d85a4883057a46" - }, - "conversion": { - "sourceId": "/items/26/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Malware detections over time summarizing the data daily by various Malware URL threat based detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Malware'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand MalwareMethod = ParsedMethods.Malware\r\n| where MalwareMethod contains \"URL\"\r\n| summarize Count = count() by MalwareMethod = tostring(MalwareMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct MalwareMethod | extend d = 1) on d | project Timestamp, MalwareMethod\r\n| join kind=leftouter (agg) on Timestamp, MalwareMethod\r\n| project Timestamp, MalwareMethod, Count = coalesce(Count, 0)\r\n| sort by MalwareMethod asc, Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/26/content/items/2/content/query", - "sourceSha256": "9daabfabfcb9f9a343c05b6a9a3628be01341908ce2121be22d85a4883057a46", - "targetSha256": "9daabfabfcb9f9a343c05b6a9a3628be01341908ce2121be22d85a4883057a46" - }, - { - "sourcePath": "/items/26/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "c6bcb12df3ef848861601923d5e929e0aca00db63f4ee330eca357d9ad0d23f3" - }, - "conversion": { - "sourceId": "/items/26/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total emails with Phishing detections over time summarizing the data daily by various Phishing URL threat based detection technologies/controls in Microsoft Defender for Office 365.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has 'Phish'\r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ParsedMethods = parse_json(DetectionMethods)\r\n| mv-expand PhishMethod = ParsedMethods.Phish\r\n| where PhishMethod contains \"URL\"\r\n| summarize Count = count() by PhishMethod = tostring(PhishMethod), Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct PhishMethod | extend d = 1) on d | project Timestamp, PhishMethod\r\n| join kind=leftouter (agg) on Timestamp, PhishMethod\r\n| project Timestamp, PhishMethod, Count = coalesce(Count, 0)\r\n| sort by PhishMethod asc, Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/26/content/items/4/content/query", - "sourceSha256": "c6bcb12df3ef848861601923d5e929e0aca00db63f4ee330eca357d9ad0d23f3", - "targetSha256": "c6bcb12df3ef848861601923d5e929e0aca00db63f4ee330eca357d9ad0d23f3" - }, - { - "sourcePath": "/items/26/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "136feab1afc6191911f3781f8201b9e02054f87628fe384f51b0053e4b212071" - }, - "conversion": { - "sourceId": "/items/26/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where EmailDirection == \"Inbound\" \r\n| where DetectionMethods has \"Url\"\r\n| join EmailUrlInfo on NetworkMessageId\r\n| where UrlLocation == \"QRCode\"\r\n| summarize [\"Phish QR Detection\"]=countif(parse_json(DetectionMethods).Phish has \"URL\"), [\"Malware QR Detection\"]=countif(parse_json(DetectionMethods).Malware has \"URL\"), [\"Spam QR Detection\"]=countif(parse_json(DetectionMethods).Spam has \"URL\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Phish QR Detection\"]=coalesce([\"Phish QR Detection\"],0), [\"Malware QR Detection\"]=coalesce([\"Malware QR Detection\"],0), [\"Spam QR Detection\"]=coalesce([\"Spam QR Detection\"],0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents", - "EmailUrlInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailUrlInfo", - "ahTable": "EmailUrlInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 7, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/26/content/items/7/content/query", - "sourceSha256": "136feab1afc6191911f3781f8201b9e02054f87628fe384f51b0053e4b212071", - "targetSha256": "136feab1afc6191911f3781f8201b9e02054f87628fe384f51b0053e4b212071" - }, - { - "sourcePath": "/items/26/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "3629b626438ea9a517079ccccb7998cfa0f2f23d6b901a435b17db6fa975f169" - }, - "conversion": { - "sourceId": "/items/26/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises where URL's have been scanned identified from various locations in emails\r\nEmailUrlInfo\r\n| summarize count() by UrlLocation", - "resolvedTables": [ - "EmailUrlInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailUrlInfo", - "ahTable": "EmailUrlInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 7, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/26/content/items/8/content/query", - "sourceSha256": "3629b626438ea9a517079ccccb7998cfa0f2f23d6b901a435b17db6fa975f169", - "targetSha256": "3629b626438ea9a517079ccccb7998cfa0f2f23d6b901a435b17db6fa975f169" - }, - { - "sourcePath": "/items/27/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "de9936de60014beaf4994b55a62748796df10357de12757d8a45935de883aa77" - }, - "conversion": { - "sourceId": "/items/27/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// Generates a time-series analysis for blocked URL click events from the 'UrlClickEvents' table\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where isnotempty(ActionType)\r\n| where ActionType has_any(\"ClickBlocked\")\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, BlockedClicks = coalesce(Count, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents", - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/27/content/items/2/content/query", - "sourceSha256": "de9936de60014beaf4994b55a62748796df10357de12757d8a45935de883aa77", - "targetSha256": "de9936de60014beaf4994b55a62748796df10357de12757d8a45935de883aa77" - }, - { - "sourcePath": "/items/27/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "d64b0ab24acbc83afb51a6cdd483334e3fa2104a6254214d051b53905d37212d" - }, - "conversion": { - "sourceId": "/items/27/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of click attempts on URL's with detections split by the different threat types identified\r\nUrlClickEvents\r\n| where isnotempty(ThreatTypes)\r\n| summarize count() by ThreatTypes", - "resolvedTables": [ - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/27/content/items/3/content/query", - "sourceSha256": "d64b0ab24acbc83afb51a6cdd483334e3fa2104a6254214d051b53905d37212d", - "targetSha256": "d64b0ab24acbc83afb51a6cdd483334e3fa2104a6254214d051b53905d37212d" - }, - { - "sourcePath": "/items/27/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "744fd3158cce723e09e1dc24686787d492bae7d213699246837e5936806f0197" - }, - "conversion": { - "sourceId": "/items/27/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises different URL click event types by action (e.g., blocked, allowed, pending verdict, error pages, and clicked through), summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where isnotempty(ActionType)\r\n| summarize ClickBlocked=countif(ActionType has_any(\"ClickBlocked\")), ClickAllowed=countif(ActionType has_any(\"ClickAllowed\")), PendingVerdict=countif(ActionType has_any(\"UrlScanInProgress\")), ErrorPage=countif(ActionType has_any(\"UrlErrorPage\")), ClickedThrough=countif(IsClickedThrough == true) by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ClickBlocked=coalesce(ClickBlocked,0), ClickAllowed=coalesce(ClickAllowed,0), PendingVerdict=coalesce(PendingVerdict,0), ErrorPage=coalesce(ErrorPage,0), ClickedThrough=coalesce(ClickedThrough,0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents", - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/27/content/items/6/content/query", - "sourceSha256": "744fd3158cce723e09e1dc24686787d492bae7d213699246837e5936806f0197", - "targetSha256": "744fd3158cce723e09e1dc24686787d492bae7d213699246837e5936806f0197" - }, - { - "sourcePath": "/items/27/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "8429ae089810f55dc95903d431c16664edf954083e661b7a073a232c8f4eba90" - }, - "conversion": { - "sourceId": "/items/27/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises where URL clicks scanned by the Workload the click happened from\r\nUrlClickEvents\r\n| summarize count() by Workload", - "resolvedTables": [ - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/27/content/items/7/content/query", - "sourceSha256": "8429ae089810f55dc95903d431c16664edf954083e661b7a073a232c8f4eba90", - "targetSha256": "8429ae089810f55dc95903d431c16664edf954083e661b7a073a232c8f4eba90" - }, - { - "sourcePath": "/items/27/content/items/10/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "eaf620ac0615ffcdfc3897483b5032a495ab79fd549ab9632890d43ff5829b7d" - }, - "conversion": { - "sourceId": "/items/27/content/items/10/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises blocked URL click event types by Workload (e.g., Email, Teams, Office, Microsoft 365 Copilot), summarizing the data daily\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where ActionType ==\"ClickBlocked\"\r\n| summarize Teams=countif(Workload==\"Teams\"), Office=countif(Workload==\"Office\"), Email=countif(Workload==\"Email\"), Copilot=countif(Workload==\"Copilot\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, Teams=coalesce(Teams,0), Office=coalesce(Office,0), Email=coalesce(Email,0), Copilot=coalesce(Copilot,0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents", - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/27/content/items/10/content/query", - "sourceSha256": "eaf620ac0615ffcdfc3897483b5032a495ab79fd549ab9632890d43ff5829b7d", - "targetSha256": "eaf620ac0615ffcdfc3897483b5032a495ab79fd549ab9632890d43ff5829b7d" - }, - { - "sourcePath": "/items/27/content/items/11/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "0bf2451c7dfd76eee94ff4124828ce2b680dbd19e088d2349a438a86a150e1d1" - }, - "conversion": { - "sourceId": "/items/27/content/items/11/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of click-through activities on URL's with detections split by the source client\r\nUrlClickEvents \r\n| where IsClickedThrough !=\"0\"\r\n| where isnotempty(ThreatTypes) \r\n| summarize count() by Workload", - "resolvedTables": [ - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/27/content/items/11/content/query", - "sourceSha256": "0bf2451c7dfd76eee94ff4124828ce2b680dbd19e088d2349a438a86a150e1d1", - "targetSha256": "0bf2451c7dfd76eee94ff4124828ce2b680dbd19e088d2349a438a86a150e1d1" - }, - { - "sourcePath": "/items/27/content/items/13/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "38b2d7e0174c44ebdbf8a4c715c5adfbd101c732af0b9d346b36583eeee59f5a" - }, - "conversion": { - "sourceId": "/items/27/content/items/13/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query shows the top 20 URL's that have a detection associated with the most ammount of clicks registered \r\nUrlClickEvents\r\n| where ThreatTypes !=\"\"\r\n| summarize count() by Url, ThreatTypes, ActionType, Workload\r\n| top 20 by count_\r\n| project ['URL']=Url, ['Threat Types']=ThreatTypes, ['Action Type']=ActionType, Workload, ['Click Count']=count_", - "resolvedTables": [ - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/27/content/items/13/content/query", - "sourceSha256": "38b2d7e0174c44ebdbf8a4c715c5adfbd101c732af0b9d346b36583eeee59f5a", - "targetSha256": "38b2d7e0174c44ebdbf8a4c715c5adfbd101c732af0b9d346b36583eeee59f5a" - }, - { - "sourcePath": "/items/28/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "db5f05baf90ec7c16a38f3233a08b5a6e7269dce3e582c57e664ddc428032b2c" - }, - "conversion": { - "sourceId": "/items/28/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the top 10 users with click attempts on URL's with malware detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),MalwareClickCount = countif(ThreatTypes has \"Malware\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(MalwareClickCount / todouble(TotalClickCount) *100, 2))\r\n| where MalwareClickCount !=0\r\n| sort by MalwareClickCount desc\r\n| top 15 by MalwareClickCount\r\n| project ['User']=AccountUpn, ['Malware Clicks']=MalwareClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage", - "resolvedTables": [ - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/28/content/items/2/content/query", - "sourceSha256": "db5f05baf90ec7c16a38f3233a08b5a6e7269dce3e582c57e664ddc428032b2c", - "targetSha256": "db5f05baf90ec7c16a38f3233a08b5a6e7269dce3e582c57e664ddc428032b2c" - }, - { - "sourcePath": "/items/28/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "07a9bf36177e24ca6af9f2a2db7e5a2de3717ae986fee891f6a70908ec57aad0" - }, - "conversion": { - "sourceId": "/items/28/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the top 10 users with click attempts on URL's with Phish detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),PhishClickCount = countif(ThreatTypes has \"Phish\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(PhishClickCount / todouble(TotalClickCount) *100, 2))\r\n| where PhishClickCount !=0\r\n| sort by PhishClickCount desc\r\n| top 15 by PhishClickCount\r\n| project ['User']=AccountUpn, ['Phish Clicks']=PhishClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage", - "resolvedTables": [ - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/28/content/items/4/content/query", - "sourceSha256": "07a9bf36177e24ca6af9f2a2db7e5a2de3717ae986fee891f6a70908ec57aad0", - "targetSha256": "07a9bf36177e24ca6af9f2a2db7e5a2de3717ae986fee891f6a70908ec57aad0" - }, - { - "sourcePath": "/items/28/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "ed27048ae55d9fc1d918d46c209d96cb434835c7cac40c7ebb48ad64b1f8529d" - }, - "conversion": { - "sourceId": "/items/28/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the top 10 users with click attempts on URL's with Spam detections\r\nUrlClickEvents\r\n| summarize TotalClickCount=count(),SpamClickCount = countif(ThreatTypes has \"Spam\") by AccountUpn\r\n| extend Bad_Click_Percentage = todouble(round(SpamClickCount / todouble(TotalClickCount) *100, 2))\r\n| where SpamClickCount !=0\r\n| sort by SpamClickCount desc\r\n| top 15 by SpamClickCount\r\n| project ['User']=AccountUpn, ['Spam Clicks']=SpamClickCount, ['Total Clicks']=TotalClickCount, ['Bad Click %']=Bad_Click_Percentage", - "resolvedTables": [ - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/28/content/items/6/content/query", - "sourceSha256": "ed27048ae55d9fc1d918d46c209d96cb434835c7cac40c7ebb48ad64b1f8529d", - "targetSha256": "ed27048ae55d9fc1d918d46c209d96cb434835c7cac40c7ebb48ad64b1f8529d" - }, - { - "sourcePath": "/items/30/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "7112638b0b50795d443ced8d00eaa0c220c8aa565ac8be30f20061f075662eaf" - }, - "conversion": { - "sourceId": "/items/30/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Headline Microsoft Teams protection metrics for the selected period, with per-interval sparklines. Messages are de-duplicated to the latest record per Teams message.\r\nlet gran = {Granularity};\r\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\r\nlet zap = materialize(MessagePostDeliveryEvents);\r\nunion\r\n(msgs | summarize Count = count() | extend Details = \"Teams Messages Scanned\", Ord = 1, Trend = toscalar(msgs | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Messages with Threats\", Ord = 2, Trend = toscalar(msgs | where isnotempty(ThreatTypes) | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Phish\" | summarize Count = count() | extend Details = \"Phish Detections\", Ord = 3, Trend = toscalar(msgs | where ThreatTypes has \"Phish\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Malware\" | summarize Count = count() | extend Details = \"Malware Detections\", Ord = 4, Trend = toscalar(msgs | where ThreatTypes has \"Malware\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where ThreatTypes has \"Spam\" | summarize Count = count() | extend Details = \"Spam Detections\", Ord = 5, Trend = toscalar(msgs | where ThreatTypes has \"Spam\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(msgs | where SafetyTip == \"URLMessageWarning\" | summarize Count = count() | extend Details = \"Messages with URL Warning\", Ord = 6, Trend = toscalar(msgs | where SafetyTip == \"URLMessageWarning\" | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(zap | summarize Count = count() | extend Details = \"Post-Delivery ZAP Actions\", Ord = 7, Trend = toscalar(zap | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend", - "resolvedTables": [ - "MessageEvents", - "MessagePostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - }, - { - "sentinelTable": "MessagePostDeliveryEvents", - "ahTable": "MessagePostDeliveryEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/30/content/query", - "sourceSha256": "7112638b0b50795d443ced8d00eaa0c220c8aa565ac8be30f20061f075662eaf", - "targetSha256": "7112638b0b50795d443ced8d00eaa0c220c8aa565ac8be30f20061f075662eaf" - }, - { - "sourcePath": "/items/31/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "addfc8701d3b8ad0712bae67511363b79bc36017bc20156253fc121355e30cb2" - }, - "conversion": { - "sourceId": "/items/31/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the number of Microsoft Teams messages detected with a threat over time, de-duplicated to the latest record per message and summarized per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(MessageEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(MessageEvents | summarize max(Timestamp));\r\nlet agg = materialize(MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId | summarize ThreatDetections = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ThreatDetections = coalesce(ThreatDetections, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "MessageEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/31/content/items/2/content/query", - "sourceSha256": "addfc8701d3b8ad0712bae67511363b79bc36017bc20156253fc121355e30cb2", - "targetSha256": "addfc8701d3b8ad0712bae67511363b79bc36017bc20156253fc121355e30cb2" - }, - { - "sourcePath": "/items/31/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "115d80895a5be2c85508f27e76a48f554b8cd9365d1d7821be31df99aeff3468" - }, - "conversion": { - "sourceId": "/items/31/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query breaks down Microsoft Teams threat detections by threat type for the selected period, de-duplicated to the latest record per message. A message flagged for more than one threat type is counted under each, so the split can exceed the distinct message count.\r\nlet msgs = MessageEvents | where isnotempty(ThreatTypes) | summarize arg_max(Timestamp, *) by TeamsMessageId;\r\nunion\r\n(msgs | where ThreatTypes has \"Phish\" | summarize Count = count() | extend ThreatType = \"Phish\"),\r\n(msgs | where ThreatTypes has \"Malware\" | summarize Count = count() | extend ThreatType = \"Malware\"),\r\n(msgs | where ThreatTypes has \"Spam\" | summarize Count = count() | extend ThreatType = \"Spam\")\r\n| project ThreatType, Count", - "resolvedTables": [ - "MessageEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/31/content/items/5/content/query", - "sourceSha256": "115d80895a5be2c85508f27e76a48f554b8cd9365d1d7821be31df99aeff3468", - "targetSha256": "115d80895a5be2c85508f27e76a48f554b8cd9365d1d7821be31df99aeff3468" - }, - { - "sourcePath": "/items/31/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "0b301a80d30871d06c44e6d360d25e6e9e7d0385f8f0f6ab0cde02431fb234ce" - }, - "conversion": { - "sourceId": "/items/31/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants.\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| extend Thread = iif(IsExternalThread == true, \"External Thread\", \"Internal Thread\")\r\n| summarize Count = count() by Thread", - "resolvedTables": [ - "MessageEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/31/content/items/6/content/query", - "sourceSha256": "0b301a80d30871d06c44e6d360d25e6e9e7d0385f8f0f6ab0cde02431fb234ce", - "targetSha256": "0b301a80d30871d06c44e6d360d25e6e9e7d0385f8f0f6ab0cde02431fb234ce" - }, - { - "sourcePath": "/items/32/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "01f7e898b2228c641a96135b46d26b76ebd38ccb2cc77194e679106c0154294a" - }, - "conversion": { - "sourceId": "/items/32/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Teams call and vishing headline metrics for the selected period, with per-interval sparklines. Interim source: Defender for Cloud Apps call telemetry (CloudAppEvents / CallParticipantDetail).\r\nlet gran = {Granularity};\r\nlet calls = materialize(CloudAppEvents | where ActionType == \"CallParticipantDetail\" | extend R = parse_json(RawEventData) | extend CallId = tostring(R.CallId), UId = tolower(tostring(R.UserId)));\r\nlet susp = calls | extend Local = tostring(split(UId, \"@\")[0]), Dom = tostring(split(UId, \"@\")[1]) | where Local matches regex @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\" or Dom endswith \".onmicrosoft.com\";\r\nlet reported = CloudAppEvents | where ActionType == \"CallReported\";\r\nunion\r\n(calls | summarize Count = dcount(CallId) | extend Details = \"Teams Calls\", Ord = 1, Trend = toscalar(calls | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(susp | summarize Count = dcount(UId) | extend Details = \"Impersonation-style Callers\", Ord = 2, Trend = toscalar(susp | make-series S = count() default = 0 on Timestamp step gran | project S)),\r\n(reported | summarize Count = count() | extend Details = \"Reported Suspicious Calls\", Ord = 3, Trend = toscalar(reported | make-series S = count() default = 0 on Timestamp step gran | project S))\r\n| sort by Ord asc\r\n| project Details, Count, Trend", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/32/content/items/1/content/query", - "sourceSha256": "01f7e898b2228c641a96135b46d26b76ebd38ccb2cc77194e679106c0154294a", - "targetSha256": "01f7e898b2228c641a96135b46d26b76ebd38ccb2cc77194e679106c0154294a" - }, - { - "sourcePath": "/items/32/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "45ae98d1a73726b46e2511bc40a832e3d6d221c4c29c58d4a43fb54689e57a3c" - }, - "conversion": { - "sourceId": "/items/32/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Distinct Teams calls per interval (interim source: CloudAppEvents / CallParticipantDetail).\r\nCloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend CallId = tostring(R.CallId)\r\n| summarize ['Teams Calls'] = dcount(CallId) by Timestamp = bin(Timestamp, {Granularity})\r\n| sort by Timestamp asc", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/32/content/items/3/content/query", - "sourceSha256": "45ae98d1a73726b46e2511bc40a832e3d6d221c4c29c58d4a43fb54689e57a3c", - "targetSha256": "45ae98d1a73726b46e2511bc40a832e3d6d221c4c29c58d4a43fb54689e57a3c" - }, - { - "sourcePath": "/items/32/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "f7d325b8dc2aa51f9d96727937d73c8db51a5767cac539e81286497ec8653911" - }, - "conversion": { - "sourceId": "/items/32/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Teams calls by start hour of day (UTC), all 24 hours 00:00..23:00 in order (interim source: CloudAppEvents / CallParticipantDetail).\r\nlet data = CloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend JoinTime = todatetime(R.JoinTime), CallId = tostring(R.CallId)\r\n| where isnotempty(JoinTime) and isnotempty(CallId)\r\n| summarize CallStart = min(JoinTime) by CallId\r\n| extend HourUTC = hourofday(CallStart)\r\n| summarize Calls = count() by HourUTC;\r\nrange HourUTC from 0 to 23 step 1\r\n| join kind=leftouter (data) on HourUTC\r\n| extend Calls = coalesce(Calls, 0)\r\n| extend HourLabel = strcat(iif(HourUTC < 10, strcat(\"0\", tostring(HourUTC)), tostring(HourUTC)), \":00\")\r\n| order by HourUTC asc\r\n| project ['Hour of Day (UTC)'] = HourLabel, ['Teams Calls'] = Calls", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/32/content/items/5/content/query", - "sourceSha256": "f7d325b8dc2aa51f9d96727937d73c8db51a5767cac539e81286497ec8653911", - "targetSha256": "f7d325b8dc2aa51f9d96727937d73c8db51a5767cac539e81286497ec8653911" - }, - { - "sourcePath": "/items/32/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "adea6f30b1b69be99c7f0316549d391e7bcb33b5e633f0574119f2d9214996e1" - }, - "conversion": { - "sourceId": "/items/32/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Suspicious Teams callers by impersonation-style DISPLAY NAME or address (Attendees[].DisplayName / UPN), with Origin from the org's own accepted (EmailEvents inbound) domains - no tenant-id anchor. Interim source: CloudAppEvents / CallParticipantDetail.\r\nlet suspRegex = @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|sys ?admin|administrator|security|microsoft|google|apple|amazon|paypal|support|update|verif|account|password|mfa|maintenance\";\r\nlet ownDomains = toscalar(EmailEvents | where EmailDirection == \"Inbound\" | extend RD = tolower(tostring(split(RecipientEmailAddress, \"@\")[1])) | where isnotempty(RD) | summarize make_set(RD, 200));\r\nlet calls = CloudAppEvents\r\n| where ActionType == \"CallParticipantDetail\"\r\n| extend R = parse_json(RawEventData)\r\n| extend CallId = tostring(R.CallId), JoinTime = todatetime(R.JoinTime), Attendees = R.Attendees\r\n| where isnotempty(CallId);\r\nlet callAtt = calls | summarize Attendees = take_any(Attendees), JoinTime = min(JoinTime) by CallId;\r\ncallAtt\r\n| mv-expand Att = Attendees\r\n| extend Caller = tolower(tostring(Att.UPN)), CallerName = tostring(Att.DisplayName)\r\n| extend CallerDom = tostring(split(Caller, \"@\")[1])\r\n| where isnotempty(Caller)\r\n| extend SuspName = CallerName matches regex suspRegex or Caller matches regex suspRegex\r\n| where SuspName or CallerDom endswith \".onmicrosoft.com\"\r\n| extend Origin = case(CallerDom endswith \".onmicrosoft.com\", \"External (.onmicrosoft throwaway)\", set_has_element(ownDomains, CallerDom), \"Own tenant\", \"External\")\r\n| summarize CallsPlaced = dcount(CallId), FirstSeen = min(JoinTime), LastSeen = max(JoinTime) by CallerName, Caller, Origin\r\n| extend OriginRank = case(Origin == \"External (.onmicrosoft throwaway)\", 0, Origin == \"External\", 1, 2)\r\n| sort by OriginRank asc, CallsPlaced desc\r\n| take 10\r\n| project ['Caller Display Name'] = CallerName, ['Caller Address'] = Caller, ['Origin'] = Origin, ['Calls Placed'] = CallsPlaced, ['First Seen'] = FirstSeen, ['Last Seen'] = LastSeen", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/32/content/items/7/content/query", - "sourceSha256": "adea6f30b1b69be99c7f0316549d391e7bcb33b5e633f0574119f2d9214996e1", - "targetSha256": "adea6f30b1b69be99c7f0316549d391e7bcb33b5e633f0574119f2d9214996e1" - }, - { - "sourcePath": "/items/33/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "f15fa2300c726b24caf7db43d4483d40bfa9c508dad7d012d13d0689566276dc" - }, - "conversion": { - "sourceId": "/items/33/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n FakeDisplayName = tostring(RD.Sender.DisplayName),\r\n FakeSenderAddress = tostring(RD.Sender.UPN),\r\n ChatThreadId = tostring(RD.ChatThreadId),\r\n TargetUser = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nunion\r\n(imp | summarize Count=count() | extend Details=\"Impersonation Detections\", Ord=1),\r\n(imp | summarize Count=dcount(FakeSenderAddress) | extend Details=\"Distinct Fake Senders\", Ord=2),\r\n(imp | summarize Count=dcount(TargetUser) | extend Details=\"Targeted Users\", Ord=3),\r\n(imp | summarize Count=dcount(ImpersonationType) | extend Details=\"Impersonation Types\", Ord=4)\r\n| sort by Ord asc | project Count, Details", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/33/content/items/1/content/query", - "sourceSha256": "f15fa2300c726b24caf7db43d4483d40bfa9c508dad7d012d13d0689566276dc", - "targetSha256": "f15fa2300c726b24caf7db43d4483d40bfa9c508dad7d012d13d0689566276dc" - }, - { - "sourcePath": "/items/33/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "e4967734b2d441e44f883920b0ec6cee9b07bcd3dd1722796181f6cc8d7b4a72" - }, - "conversion": { - "sourceId": "/items/33/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n FakeDisplayName = tostring(RD.Sender.DisplayName),\r\n FakeSenderAddress = tostring(RD.Sender.UPN),\r\n ChatThreadId = tostring(RD.ChatThreadId),\r\n TargetUser = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Count=count() by ImpersonationType, Timestamp=bin(Timestamp, {Granularity}) | sort by Timestamp asc", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/33/content/items/3/content/query", - "sourceSha256": "e4967734b2d441e44f883920b0ec6cee9b07bcd3dd1722796181f6cc8d7b4a72", - "targetSha256": "e4967734b2d441e44f883920b0ec6cee9b07bcd3dd1722796181f6cc8d7b4a72" - }, - { - "sourcePath": "/items/33/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "da62afa3f1cca75722bef666f99f46a05ef7fda8f457f474bb01ca554ca4fd09" - }, - "conversion": { - "sourceId": "/items/33/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//External Teams senders flagged as likely impersonation: throwaway .onmicrosoft.com tenants and/or help desk / IT / admin / update-themed display names, ranked by messages carrying a threat.\r\nMessageEvents\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tolower(tostring(split(SenderEmailAddress, \"@\")[1]))\r\n| extend IsOnMicrosoft = SenderDomain endswith \".onmicrosoft.com\"\r\n| extend SuspName = SenderDisplayName matches regex @\"(?i)help ?desk|helpdesk|it ?support|service ?desk|it team|administrator|sys ?admin|security|microsoft|maintenance|support|update|verif|account|password|mfa\"\r\n| where IsOnMicrosoft or SuspName\r\n| summarize TeamsMessages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by SenderDisplayName, SenderEmailAddress, SenderDomain, IsOnMicrosoft, SuspName\r\n| extend WhyFlagged = case(IsOnMicrosoft and SuspName, \"Throwaway .onmicrosoft tenant + helpdesk-style name\", IsOnMicrosoft, \"Throwaway .onmicrosoft tenant\", \"Helpdesk / IT-style display name\")\r\n| extend ThreatPct = round(todouble(ThreatMessages) * 100 / TeamsMessages, 1)\r\n| project ['Sender Display Name']=SenderDisplayName, ['Sender Address']=SenderEmailAddress, ['Why Flagged']=WhyFlagged, ['Teams Messages']=TeamsMessages, ['Threat Messages']=ThreatMessages, ['Threat %']=ThreatPct, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen\r\n| sort by ['Threat Messages'] desc, ['Teams Messages'] desc\r\n| take 10", - "resolvedTables": [ - "MessageEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/33/content/items/5/content/query", - "sourceSha256": "da62afa3f1cca75722bef666f99f46a05ef7fda8f457f474bb01ca554ca4fd09", - "targetSha256": "da62afa3f1cca75722bef666f99f46a05ef7fda8f457f474bb01ca554ca4fd09" - }, - { - "sourcePath": "/items/33/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "4d3ec85cc0801652beb4defc4e3777955efe5ec50549c942a5a385a9b752862e" - }, - "conversion": { - "sourceId": "/items/33/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n FakeDisplayName = tostring(RD.Sender.DisplayName),\r\n FakeSenderAddress = tostring(RD.Sender.UPN),\r\n ChatThreadId = tostring(RD.ChatThreadId),\r\n TargetUser = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Distinct Fake Senders']=dcount(FakeSenderAddress), Types=make_set(ImpersonationType,3), ['Last Seen']=max(Timestamp) by ['Targeted User']=TargetUser | top 10 by Detections", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/33/content/items/7/content/query", - "sourceSha256": "4d3ec85cc0801652beb4defc4e3777955efe5ec50549c942a5a385a9b752862e", - "targetSha256": "4d3ec85cc0801652beb4defc4e3777955efe5ec50549c942a5a385a9b752862e" - }, - { - "sourcePath": "/items/33/content/items/9/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "661bce15fae66ae69300a1fda934232c266282b027c5336106bc81493c8db7a5" - }, - "conversion": { - "sourceId": "/items/33/content/items/9/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists the identities behind Teams impersonation, grouped by the fake display name, sender domain, and impersonation type. Attackers rotate through many sending addresses under one display name, so Distinct Sender Addresses reveals bulk campaigns that per-address ranking would hide.\r\nlet imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n FakeDisplayName = tostring(RD.Sender.DisplayName),\r\n FakeSenderAddress = tostring(RD.Sender.UPN),\r\n TargetUser = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp\r\n| summarize Detections=count(), SenderAddresses=dcount(FakeSenderAddress), Targets=dcount(TargetUser), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by FakeDisplayName, FakeSenderDomain, ImpersonationType\r\n| top 10 by Detections\r\n| project ['Fake Display Name']=FakeDisplayName, ['Sender Domain']=FakeSenderDomain, ['Impersonation Type']=ImpersonationType, ['Distinct Sender Addresses']=SenderAddresses, Detections, ['Targeted Users']=Targets, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/33/content/items/9/content/query", - "sourceSha256": "661bce15fae66ae69300a1fda934232c266282b027c5336106bc81493c8db7a5", - "targetSha256": "661bce15fae66ae69300a1fda934232c266282b027c5336106bc81493c8db7a5" - }, - { - "sourcePath": "/items/33/content/items/11/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "9aa119251148521f6bf62b87e883cb0d526be3da9dff9369bb312a8b9b8038fa" - }, - "conversion": { - "sourceId": "/items/33/content/items/11/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n FakeDisplayName = tostring(RD.Sender.DisplayName),\r\n FakeSenderAddress = tostring(RD.Sender.UPN),\r\n ChatThreadId = tostring(RD.ChatThreadId),\r\n TargetUser = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Distinct Senders']=dcount(FakeSenderAddress) by ['Fake Display Name']=FakeDisplayName | top 10 by Detections", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/33/content/items/11/content/query", - "sourceSha256": "9aa119251148521f6bf62b87e883cb0d526be3da9dff9369bb312a8b9b8038fa", - "targetSha256": "9aa119251148521f6bf62b87e883cb0d526be3da9dff9369bb312a8b9b8038fa" - }, - { - "sourcePath": "/items/33/content/items/13/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "200ad476ad60916ec0c869e71215911864f3e643c551fe8c5f061b783620c30f" - }, - "conversion": { - "sourceId": "/items/33/content/items/13/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "let imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ImpersonationType = tostring(RD.ImpersonationType),\r\n FakeDisplayName = tostring(RD.Sender.DisplayName),\r\n FakeSenderAddress = tostring(RD.Sender.UPN),\r\n ChatThreadId = tostring(RD.ChatThreadId),\r\n TargetUser = tostring(RD.UserId)\r\n| extend FakeSenderDomain = tostring(split(FakeSenderAddress, \"@\")[1]);\r\nimp | summarize Detections=count(), ['Targeted Users']=dcount(TargetUser), ['Display Names Used']=dcount(FakeDisplayName) by ['Sender Domain']=FakeSenderDomain | top 10 by Detections", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/33/content/items/13/content/query", - "sourceSha256": "200ad476ad60916ec0c869e71215911864f3e643c551fe8c5f061b783620c30f", - "targetSha256": "200ad476ad60916ec0c869e71215911864f3e643c551fe8c5f061b783620c30f" - }, - { - "sourcePath": "/items/33/content/items/15/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "987795e44176c715791378d800d09c992d12ec43b3c5821dacdabb5729189bc3" - }, - "conversion": { - "sourceId": "/items/33/content/items/15/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists URL domains that appeared in messages sent by impersonating senders, with a breakdown of how many carried Malware, Phish, or Spam verdicts. Threat actors mix legitimate and malicious domains in a single lure, so review the unfamiliar or look-alike domains and block only confirmed-malicious ones.\r\nlet imp = CloudAppEvents\r\n| where ActionType == \"TeamsImpersonationDetected\"\r\n| extend RD = parse_json(RawEventData)\r\n| extend ChatThreadId = tostring(RD.ChatThreadId);\r\nlet impThreads = imp | distinct ChatThreadId;\r\nlet impMsgs = MessageEvents\r\n | where ThreadId in (impThreads)\r\n | summarize arg_max(Timestamp, *) by TeamsMessageId\r\n | project TeamsMessageId, ThreatTypes;\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| join kind=inner (impMsgs) on TeamsMessageId\r\n| summarize ['URL Count']=count(), Messages=dcount(TeamsMessageId), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\") by ['URL Domain']=UrlDomain\r\n| top 10 by ['URL Count']", - "resolvedTables": [ - "CloudAppEvents", - "MessageEvents", - "MessageUrlInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - }, - { - "sentinelTable": "MessageUrlInfo", - "ahTable": "MessageUrlInfo", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/33/content/items/15/content/query", - "sourceSha256": "987795e44176c715791378d800d09c992d12ec43b3c5821dacdabb5729189bc3", - "targetSha256": "987795e44176c715791378d800d09c992d12ec43b3c5821dacdabb5729189bc3" - }, - { - "sourcePath": "/items/34/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "de4a3cd15b54b7bc12fceea891f3299f9d34e1ac844bcec0579f42f31b1f608a" - }, - "conversion": { - "sourceId": "/items/34/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query surfaces Microsoft Teams URL-sharing and link-warning metrics for the selected period. URL-warning messages carry the Microsoft Defender for Office 365 URL safety tip.\r\nlet msgs = materialize(MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId);\r\nunion\r\n(msgs | where SafetyTip == \"URLMessageWarning\" | summarize Count = count() | extend Details = \"Messages with URL Warning\", Ord = 1),\r\n(MessageUrlInfo | summarize Count = count() | extend Details = \"URLs Shared in Messages\", Ord = 2),\r\n(MessageUrlInfo | summarize Count = dcount(TeamsMessageId) | extend Details = \"Messages Containing URLs\", Ord = 3),\r\n(MessageUrlInfo | summarize Count = dcount(UrlDomain) | extend Details = \"Distinct URL Domains\", Ord = 4)\r\n| sort by Ord asc\r\n| project Count, Details", - "resolvedTables": [ - "MessageEvents", - "MessageUrlInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - }, - { - "sentinelTable": "MessageUrlInfo", - "ahTable": "MessageUrlInfo", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/34/content/items/1/content/query", - "sourceSha256": "de4a3cd15b54b7bc12fceea891f3299f9d34e1ac844bcec0579f42f31b1f608a", - "targetSha256": "de4a3cd15b54b7bc12fceea891f3299f9d34e1ac844bcec0579f42f31b1f608a" - }, - { - "sourcePath": "/items/34/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "c8b131c029c45551133d982f401722e3b74a3c7c21d34a1d6825bab48599ad96" - }, - "conversion": { - "sourceId": "/items/34/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises Microsoft Teams URL click outcomes over time (allowed vs blocked) using the UrlClickEvents workload filter, summarizing the data per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(UrlClickEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(UrlClickEvents | summarize max(Timestamp));\r\nlet agg = materialize(UrlClickEvents\r\n| where Workload == \"Teams\"\r\n| summarize ClickAllowed = countif(ActionType has \"ClickAllowed\"), ClickBlocked = countif(ActionType has \"ClickBlocked\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ClickAllowed = coalesce(ClickAllowed, 0), ClickBlocked = coalesce(ClickBlocked, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/34/content/items/4/content/query", - "sourceSha256": "c8b131c029c45551133d982f401722e3b74a3c7c21d34a1d6825bab48599ad96", - "targetSha256": "c8b131c029c45551133d982f401722e3b74a3c7c21d34a1d6825bab48599ad96" - }, - { - "sourcePath": "/items/34/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "6204df8da919ae7f5bd8f4e048027dad32c967701d8b6e1e34e0ab741503f1e4" - }, - "conversion": { - "sourceId": "/items/34/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query shows Microsoft Teams URL click outcomes by action type for the selected period.\r\nUrlClickEvents\r\n| where Workload == \"Teams\"\r\n| where isnotempty(ActionType)\r\n| summarize Count = count() by ActionType", - "resolvedTables": [ - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/34/content/items/5/content/query", - "sourceSha256": "6204df8da919ae7f5bd8f4e048027dad32c967701d8b6e1e34e0ab741503f1e4", - "targetSha256": "6204df8da919ae7f5bd8f4e048027dad32c967701d8b6e1e34e0ab741503f1e4" - }, - { - "sourcePath": "/items/34/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "36ec75051923aaa5623d7d1a4b2d36e0e93f54392269c6d32de58db718c0866a" - }, - "conversion": { - "sourceId": "/items/34/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists the top 10 URL domains shared in Microsoft Teams messages by volume for the selected period.\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| summarize UrlCount = count(), Messages = dcount(TeamsMessageId) by UrlDomain\r\n| top 10 by UrlCount\r\n| project ['URL Domain']=UrlDomain, ['URLs Shared']=UrlCount, ['Messages']=Messages", - "resolvedTables": [ - "MessageUrlInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageUrlInfo", - "ahTable": "MessageUrlInfo", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/34/content/items/7/content/query", - "sourceSha256": "36ec75051923aaa5623d7d1a4b2d36e0e93f54392269c6d32de58db718c0866a", - "targetSha256": "36ec75051923aaa5623d7d1a4b2d36e0e93f54392269c6d32de58db718c0866a" - }, - { - "sourcePath": "/items/35/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "62029ecfef97ec15504028257c2a5d2f94ce8a1d9764529436f166426143fd61" - }, - "conversion": { - "sourceId": "/items/35/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists the top 10 users receiving Microsoft Teams messages that contained a threat, expanded from the message recipient list, with each user's total Teams messages received and the share that carried a threat. Messages are de-duplicated to the latest record per message.\r\nlet expanded = MessageEvents\r\n | summarize arg_max(Timestamp, *) by TeamsMessageId\r\n | mv-expand rd = parse_json(RecipientDetails)\r\n | extend Recipient = tostring(rd.RecipientSmtpAddress)\r\n | where isnotempty(Recipient);\r\nlet totals = expanded | summarize TotalMessages = count() by Recipient;\r\nexpanded\r\n| where isnotempty(ThreatTypes)\r\n| summarize ThreatMessages = count() by Recipient\r\n| join kind=leftouter (totals) on Recipient\r\n| extend ThreatPct = round(100.0 * ThreatMessages / TotalMessages, 1)\r\n| top 10 by ThreatMessages\r\n| project ['Recipient']=Recipient, ['Threat Messages']=ThreatMessages, ['Total Messages']=TotalMessages, ['Threat %']=ThreatPct", - "resolvedTables": [ - "MessageEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/35/content/items/2/content/query", - "sourceSha256": "62029ecfef97ec15504028257c2a5d2f94ce8a1d9764529436f166426143fd61", - "targetSha256": "62029ecfef97ec15504028257c2a5d2f94ce8a1d9764529436f166426143fd61" - }, - { - "sourcePath": "/items/35/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "dffcadfd238a9e7b7648a27145cc7af9367c36cac839e2a0d4d5da8f0429a048" - }, - "conversion": { - "sourceId": "/items/35/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists the top 10 senders whose Microsoft Teams messages triggered a URL safety-tip warning for the selected period, with each sender's total Teams messages and the share that carried a warning. Messages are de-duplicated to the latest record per message.\r\nlet dedup = MessageEvents | summarize arg_max(Timestamp, *) by TeamsMessageId;\r\nlet totals = dedup | summarize TotalMessages = count() by SenderEmailAddress;\r\ndedup\r\n| where SafetyTip == \"URLMessageWarning\"\r\n| summarize WarningMessages = count() by SenderEmailAddress\r\n| join kind=leftouter (totals) on SenderEmailAddress\r\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\r\n| top 10 by WarningMessages\r\n| project ['Sender']=SenderEmailAddress, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct", - "resolvedTables": [ - "MessageEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/35/content/items/5/content/query", - "sourceSha256": "dffcadfd238a9e7b7648a27145cc7af9367c36cac839e2a0d4d5da8f0429a048", - "targetSha256": "dffcadfd238a9e7b7648a27145cc7af9367c36cac839e2a0d4d5da8f0429a048" - }, - { - "sourcePath": "/items/35/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "d6b04c158fd6f88e4f82f99f6e2b0ab2819bdef7f05cabd7eedb790785f672ef" - }, - "conversion": { - "sourceId": "/items/35/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists the top 10 URL domains appearing in Microsoft Teams messages that triggered a URL safety-tip warning, with the domain's total message appearances and the share that carried a warning.\r\nlet warned = MessageEvents | where SafetyTip == \"URLMessageWarning\" | distinct TeamsMessageId;\r\nlet totals = MessageUrlInfo | where isnotempty(UrlDomain) | summarize TotalMessages = dcount(TeamsMessageId) by UrlDomain;\r\nMessageUrlInfo\r\n| where TeamsMessageId in (warned)\r\n| summarize WarningMessages = dcount(TeamsMessageId) by UrlDomain\r\n| join kind=leftouter (totals) on UrlDomain\r\n| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)\r\n| top 10 by WarningMessages\r\n| project ['URL Domain']=UrlDomain, ['Warning Messages']=WarningMessages, ['Total Messages']=TotalMessages, ['Warning %']=WarningPct", - "resolvedTables": [ - "MessageEvents", - "MessageUrlInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - }, - { - "sentinelTable": "MessageUrlInfo", - "ahTable": "MessageUrlInfo", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/35/content/items/6/content/query", - "sourceSha256": "d6b04c158fd6f88e4f82f99f6e2b0ab2819bdef7f05cabd7eedb790785f672ef", - "targetSha256": "d6b04c158fd6f88e4f82f99f6e2b0ab2819bdef7f05cabd7eedb790785f672ef" - }, - { - "sourcePath": "/items/35/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "95180a15fb5a1004fcd60cd3fe6ba3b87f78e527c750d1d34c9dd1479c5b7bca" - }, - "conversion": { - "sourceId": "/items/35/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists external Microsoft Teams senders by the date they were first seen in the selected period, surfacing recent first-contact senders. Messages are de-duplicated to the latest record per message. In tenants with longer history this highlights genuinely new senders.\r\n// TIP: IsExternalThread may still surface senders from your own accepted domains. To hide them,\r\n// uncomment the ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n//| where tostring(split(SenderEmailAddress, \"@\")[1]) !in~ (ExcludeDomains)\r\n| summarize FirstSeen = min(Timestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderEmailAddress\r\n| top 10 by FirstSeen desc\r\n| project ['Sender']=SenderEmailAddress, ['First Seen']=FirstSeen, ['Messages']=Messages, ['Threat Messages']=ThreatMessages", - "resolvedTables": [ - "MessageEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/35/content/items/8/content/query", - "sourceSha256": "95180a15fb5a1004fcd60cd3fe6ba3b87f78e527c750d1d34c9dd1479c5b7bca", - "targetSha256": "95180a15fb5a1004fcd60cd3fe6ba3b87f78e527c750d1d34c9dd1479c5b7bca" - }, - { - "sourcePath": "/items/35/content/items/10/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "a4b746884de5bb6d00bda9112992bd181df314fcbd1fc660bf27f346bc48659f" - }, - "conversion": { - "sourceId": "/items/35/content/items/10/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query ranks external sender domains in Microsoft Teams by threat volume for the selected period, split by conversation type (1:1 chat, group chat, channel), with threat-type breakdown, threat rate, and a count of messages carrying low-reputation URL TLDs. Messages are de-duplicated to the latest record per message. New, 1:1-skewed, or high-threat-rate domains are the anomalies to review.\r\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\r\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nlet suspUrlMsgs = MessageUrlInfo\r\n | where isnotempty(UrlDomain)\r\n | extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n | where Tld in (suspTlds)\r\n | distinct TeamsMessageId;\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| extend ConvType = case(isnotempty(GroupId), \"Channel\", array_length(todynamic(RecipientDetails)) > 1, \"Group chat\", \"1:1 chat\")\r\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\r\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\"1:1 chat\"), GroupChat=countif(ConvType==\"Group chat\"), ChannelMsgs=countif(ConvType==\"Channel\"), ThreatMessages=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\"), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\r\n| where ThreatMessages > 0\r\n| extend ThreatRatePct = round(100.0 * ThreatMessages / Messages, 1)\r\n| top 10 by ThreatMessages desc\r\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Threat Msgs']=ThreatMessages, Malware, Phish, Spam, ['Threat Rate %']=ThreatRatePct, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen", - "resolvedTables": [ - "MessageEvents", - "MessageUrlInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - }, - { - "sentinelTable": "MessageUrlInfo", - "ahTable": "MessageUrlInfo", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/35/content/items/10/content/query", - "sourceSha256": "a4b746884de5bb6d00bda9112992bd181df314fcbd1fc660bf27f346bc48659f", - "targetSha256": "a4b746884de5bb6d00bda9112992bd181df314fcbd1fc660bf27f346bc48659f" - }, - { - "sourcePath": "/items/35/content/items/12/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "f2a08f578478be075836e68925004bcec49cde95c39255ae9e47d528567de15a" - }, - "conversion": { - "sourceId": "/items/35/content/items/12/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query surfaces external sender domains in Microsoft Teams that have NO threat verdict yet but are sending messages with low-reputation URL TLDs or unusual volume, split by conversation type. These are early-warning senders that have not tripped a detection. Messages are de-duplicated to the latest record per message.\r\n// TIP: IsExternalThread may still surface your own accepted domains. To hide them, uncomment the\r\n// ExcludeDomains line below (add your tenant domains) and the matching where-clause.\r\n//let ExcludeDomains = dynamic([\"contoso.com\",\"contoso.com\"]);\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nlet suspUrlMsgs = MessageUrlInfo\r\n | where isnotempty(UrlDomain)\r\n | extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n | where Tld in (suspTlds)\r\n | distinct TeamsMessageId;\r\nMessageEvents\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| where IsExternalThread == true\r\n| extend SenderDomain = tostring(split(SenderEmailAddress, \"@\")[1])\r\n| where isnotempty(SenderDomain)\r\n//| where SenderDomain !in~ (ExcludeDomains)\r\n| extend ConvType = case(isnotempty(GroupId), \"Channel\", array_length(todynamic(RecipientDetails)) > 1, \"Group chat\", \"1:1 chat\")\r\n| extend HasSuspUrl = TeamsMessageId in (suspUrlMsgs)\r\n| summarize Messages=count(), Senders=dcount(SenderEmailAddress), OneToOne=countif(ConvType==\"1:1 chat\"), GroupChat=countif(ConvType==\"Group chat\"), ChannelMsgs=countif(ConvType==\"Channel\"), ThreatMessages=countif(isnotempty(ThreatTypes)), SuspUrlMsgs=countif(HasSuspUrl), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SenderDomain\r\n| where ThreatMessages == 0\r\n| where SuspUrlMsgs > 0 or Messages >= 5\r\n| order by SuspUrlMsgs desc, Messages desc\r\n| take 10\r\n| project ['Sender Domain']=SenderDomain, Messages, Senders, ['1:1']=OneToOne, ['Group']=GroupChat, ['Channel']=ChannelMsgs, ['Low-Rep URL Msgs']=SuspUrlMsgs, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen", - "resolvedTables": [ - "MessageEvents", - "MessageUrlInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - }, - { - "sentinelTable": "MessageUrlInfo", - "ahTable": "MessageUrlInfo", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/35/content/items/12/content/query", - "sourceSha256": "f2a08f578478be075836e68925004bcec49cde95c39255ae9e47d528567de15a", - "targetSha256": "f2a08f578478be075836e68925004bcec49cde95c39255ae9e47d528567de15a" - }, - { - "sourcePath": "/items/35/content/items/14/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "9481873a44f8ed6dfbf0fd5482557b2162572334750bd1d4a742f46c0109f2b5" - }, - "conversion": { - "sourceId": "/items/35/content/items/14/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists URL domains shared in Microsoft Teams that use low-reputation TLDs commonly abused for phishing and malware, ranked by the number of Teams messages they appeared in, with first- and last-seen. Treat high-reach or newly-seen domains as candidate indicators of compromise.\r\nlet suspTlds = dynamic([\"top\",\"xyz\",\"click\",\"link\",\"shop\",\"online\",\"site\",\"live\",\"icu\",\"cyou\",\"sbs\",\"rest\",\"quest\",\"cfd\",\"bond\",\"buzz\",\"fun\",\"space\",\"monster\",\"work\",\"tk\",\"ml\",\"ga\",\"cf\",\"gq\",\"dev\",\"app\",\"zip\",\"mov\",\"info\",\"win\",\"loan\",\"men\",\"stream\",\"country\"]);\r\nMessageUrlInfo\r\n| where isnotempty(UrlDomain)\r\n| extend Tld = tostring(split(UrlDomain, \".\")[-1])\r\n| where Tld in (suspTlds)\r\n| summarize Messages=dcount(TeamsMessageId), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ['URL Domain']=UrlDomain, ['TLD']=Tld\r\n| top 10 by Messages desc", - "resolvedTables": [ - "MessageUrlInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageUrlInfo", - "ahTable": "MessageUrlInfo", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/35/content/items/14/content/query", - "sourceSha256": "9481873a44f8ed6dfbf0fd5482557b2162572334750bd1d4a742f46c0109f2b5", - "targetSha256": "9481873a44f8ed6dfbf0fd5482557b2162572334750bd1d4a742f46c0109f2b5" - }, - { - "sourcePath": "/items/36/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "4b63c2185466fb2c0dbb2ac9cf40db7e8cc9937e1fe634739b699730519de15f" - }, - "conversion": { - "sourceId": "/items/36/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query summarizes Microsoft Teams file protection by Microsoft Defender for Office 365 - files scanned, files with malware detected, and files scanned with no detection - for the selected period.\r\nlet base = FileMaliciousContentInfo | where Workload == \"MicrosoftTeams\";\r\nunion\r\n(base | summarize Count = count() | extend Details = \"Teams Files Scanned\", Ord = 1),\r\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files with Malware Detected\", Ord = 2),\r\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Details = \"Files Scanned - No Detection\", Ord = 3)\r\n| sort by Ord asc\r\n| project Count, Details", - "resolvedTables": [ - "FileMaliciousContentInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "FileMaliciousContentInfo", - "ahTable": "FileMaliciousContentInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 17, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/36/content/items/1/content/query", - "sourceSha256": "4b63c2185466fb2c0dbb2ac9cf40db7e8cc9937e1fe634739b699730519de15f", - "targetSha256": "4b63c2185466fb2c0dbb2ac9cf40db7e8cc9937e1fe634739b699730519de15f" - }, - { - "sourcePath": "/items/36/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "dcb287d16b575c18bc08e9b93108034de2a21143f6c2cffc4d6afb357f0467c9" - }, - "conversion": { - "sourceId": "/items/36/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365 for the selected period.\r\nFileMaliciousContentInfo\r\n| where Workload == \"MicrosoftTeams\"\r\n| where isnotempty(ThreatTypes)\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['File Name']=FileName, ['Threat Type']=tostring(ThreatTypes), ['Threat Names']=ThreatNames, ['File Location']=FolderPath, ['File Owner']=FileOwnerUpn, SHA256", - "resolvedTables": [ - "FileMaliciousContentInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "FileMaliciousContentInfo", - "ahTable": "FileMaliciousContentInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 17, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/36/content/items/3/content/query", - "sourceSha256": "dcb287d16b575c18bc08e9b93108034de2a21143f6c2cffc4d6afb357f0467c9", - "targetSha256": "dcb287d16b575c18bc08e9b93108034de2a21143f6c2cffc4d6afb357f0467c9" - }, - { - "sourcePath": "/items/37/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "d56012dfdfeab7ea980d7397bb06f4dc4f525632b6e855c3f630cb3bdfe53004" - }, - "conversion": { - "sourceId": "/items/37/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query summarizes Microsoft Teams post-delivery ZAP (zero-hour auto purge) activity by Microsoft Defender for Office 365 for the selected period.\r\nlet zap = materialize(MessagePostDeliveryEvents);\r\nunion\r\n(zap | summarize Count = count() | extend Details = \"Total ZAP Actions\", Ord = 1),\r\n(zap | where ActionType == \"Malware ZAP\" | summarize Count = count() | extend Details = \"Malware ZAP\", Ord = 2),\r\n(zap | where ActionType == \"Phish ZAP\" | summarize Count = count() | extend Details = \"Phish ZAP\", Ord = 3),\r\n(zap | where ActionResult == \"Success\" | summarize Count = count() | extend Details = \"Successful Actions\", Ord = 4),\r\n(zap | where ActionResult == \"Failed\" | summarize Count = count() | extend Details = \"Failed Actions\", Ord = 5),\r\n(zap | where Action == \"Moved to quarantine\" | summarize Count = count() | extend Details = \"Moved to Quarantine\", Ord = 6)\r\n| sort by Ord asc\r\n| project Count, Details", - "resolvedTables": [ - "MessagePostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessagePostDeliveryEvents", - "ahTable": "MessagePostDeliveryEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/37/content/items/1/content/query", - "sourceSha256": "d56012dfdfeab7ea980d7397bb06f4dc4f525632b6e855c3f630cb3bdfe53004", - "targetSha256": "d56012dfdfeab7ea980d7397bb06f4dc4f525632b6e855c3f630cb3bdfe53004" - }, - { - "sourcePath": "/items/37/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "b2e02ff93ae4800c4296fa4e53f2e91f2124a861d267f8c3f37eeac9bf1406f0" - }, - "conversion": { - "sourceId": "/items/37/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises Microsoft Teams post-delivery ZAP actions over time by ZAP type, summarizing the data per selected interval.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(MessagePostDeliveryEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(MessagePostDeliveryEvents | summarize max(Timestamp));\r\nlet agg = materialize(MessagePostDeliveryEvents\r\n| summarize MalwareZAP = countif(ActionType == \"Malware ZAP\"), PhishZAP = countif(ActionType == \"Phish ZAP\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, MalwareZAP = coalesce(MalwareZAP, 0), PhishZAP = coalesce(PhishZAP, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "MessagePostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessagePostDeliveryEvents", - "ahTable": "MessagePostDeliveryEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/37/content/items/4/content/query", - "sourceSha256": "b2e02ff93ae4800c4296fa4e53f2e91f2124a861d267f8c3f37eeac9bf1406f0", - "targetSha256": "b2e02ff93ae4800c4296fa4e53f2e91f2124a861d267f8c3f37eeac9bf1406f0" - }, - { - "sourcePath": "/items/37/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "6797ba254b49a324742a1644fa0f7b25f1ca5ec2dbcc89de72f01557f3fa6e51" - }, - "conversion": { - "sourceId": "/items/37/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query shows Microsoft Teams post-delivery ZAP actions by type for the selected period.\r\nMessagePostDeliveryEvents\r\n| summarize Count = count() by ActionType", - "resolvedTables": [ - "MessagePostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessagePostDeliveryEvents", - "ahTable": "MessagePostDeliveryEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/37/content/items/5/content/query", - "sourceSha256": "6797ba254b49a324742a1644fa0f7b25f1ca5ec2dbcc89de72f01557f3fa6e51", - "targetSha256": "6797ba254b49a324742a1644fa0f7b25f1ca5ec2dbcc89de72f01557f3fa6e51" - }, - { - "sourcePath": "/items/37/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "5b242c6518220d383b9aaf3c3c322115b22b7599436fa6aa50afb33584cd5ca7" - }, - "conversion": { - "sourceId": "/items/37/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists the top 10 senders whose Microsoft Teams messages were removed by post-delivery ZAP for the selected period.\r\nMessagePostDeliveryEvents\r\n| where isnotempty(SenderEmailAddress)\r\n| summarize ZapActions = count(), MalwareZAP = countif(ActionType == \"Malware ZAP\"), PhishZAP = countif(ActionType == \"Phish ZAP\") by SenderEmailAddress\r\n| top 10 by ZapActions\r\n| project ['Sender']=SenderEmailAddress, ['ZAP Actions']=ZapActions, ['Malware ZAP']=MalwareZAP, ['Phish ZAP']=PhishZAP", - "resolvedTables": [ - "MessagePostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessagePostDeliveryEvents", - "ahTable": "MessagePostDeliveryEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/37/content/items/7/content/query", - "sourceSha256": "5b242c6518220d383b9aaf3c3c322115b22b7599436fa6aa50afb33584cd5ca7", - "targetSha256": "5b242c6518220d383b9aaf3c3c322115b22b7599436fa6aa50afb33584cd5ca7" - }, - { - "sourcePath": "/items/38/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "74c47338b18595934a5cd4d8876022224fd7af6ac94bd7800a49d61c645afbcb" - }, - "conversion": { - "sourceId": "/items/38/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query summarizes Microsoft Teams message and call submissions reported to Microsoft for the selected period, split by user and admin reports. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\r\nlet sub = materialize(CloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType in (\"ChatMessage\", \"TeamsCall\"));\r\nunion\r\n(sub | where SubmissionContentType == \"ChatMessage\" and ActionType == \"UserSubmission\" | summarize Count = count() | extend Details = \"Messages Reported by Users\", Ord = 1),\r\n(sub | where SubmissionContentType == \"TeamsCall\" and ActionType == \"UserSubmission\" | summarize Count = count() | extend Details = \"Calls Reported by Users\", Ord = 2),\r\n(sub | where SubmissionContentType == \"ChatMessage\" and ActionType == \"AdminSubmission\" | summarize Count = count() | extend Details = \"Messages Submitted by Admins\", Ord = 3)\r\n| sort by Ord asc\r\n| project Count, Details", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/38/content/items/1/content/query", - "sourceSha256": "74c47338b18595934a5cd4d8876022224fd7af6ac94bd7800a49d61c645afbcb", - "targetSha256": "74c47338b18595934a5cd4d8876022224fd7af6ac94bd7800a49d61c645afbcb" - }, - { - "sourcePath": "/items/38/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "6afdeb4bbcf6ec7dab9d2f4a84fad1abc3b552b5228a31eb14a60f5e6ec0e6ee" - }, - "conversion": { - "sourceId": "/items/38/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises Microsoft Teams message and call submissions over time, summarizing the data per selected interval. Only completed submissions are counted (submission triage/timeout lifecycle records are excluded).\r\nlet gran = {Granularity};\r\nlet sub = materialize(CloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType in (\"ChatMessage\", \"TeamsCall\"));\r\nlet minTime = toscalar(sub | summarize min(Timestamp));\r\nlet maxTime = toscalar(sub | summarize max(Timestamp));\r\nlet agg = materialize(sub\r\n| summarize UserReports = countif(ActionType == \"UserSubmission\"), AdminReports = countif(ActionType == \"AdminSubmission\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, UserReports = coalesce(UserReports, 0), AdminReports = coalesce(AdminReports, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/38/content/items/4/content/query", - "sourceSha256": "6afdeb4bbcf6ec7dab9d2f4a84fad1abc3b552b5228a31eb14a60f5e6ec0e6ee", - "targetSha256": "6afdeb4bbcf6ec7dab9d2f4a84fad1abc3b552b5228a31eb14a60f5e6ec0e6ee" - }, - { - "sourcePath": "/items/38/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "d5f5be5c1701660a6b52e02e0a43917c49bed7cc2745efdb9436e3b7ca68aebd" - }, - "conversion": { - "sourceId": "/items/38/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query shows the mix of Microsoft Teams submissions by content type and reporter for the selected period. Only completed user submissions (chat and call) and admin submissions (chat) are counted; submission triage/timeout lifecycle records are excluded.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\"\r\n| where (SubmissionContentType == \"ChatMessage\" and ActionType == \"UserSubmission\")\r\n or (SubmissionContentType == \"TeamsCall\" and ActionType == \"UserSubmission\")\r\n or (SubmissionContentType == \"ChatMessage\" and ActionType == \"AdminSubmission\")\r\n| extend Reporter = iif(ActionType == \"AdminSubmission\", \"Admin\", \"User\")\r\n| summarize Count = count() by SubmissionType = strcat(SubmissionContentType, \" (\", Reporter, \")\")", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/38/content/items/5/content/query", - "sourceSha256": "d5f5be5c1701660a6b52e02e0a43917c49bed7cc2745efdb9436e3b7ca68aebd", - "targetSha256": "d5f5be5c1701660a6b52e02e0a43917c49bed7cc2745efdb9436e3b7ca68aebd" - }, - { - "sourcePath": "/items/38/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "20e3b3ec8989478391f8c351684f4697b1865b0cce1f6b155f62529395a26344" - }, - "conversion": { - "sourceId": "/items/38/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query shows Microsoft Teams user (false negative) message submissions by submission state (for example Rescaned, Graded), to track processing status.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend SubmissionState = tostring(RD.SubmissionState)\r\n| summarize Count = count() by tostring(SubmissionState)", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/38/content/items/8/content/query", - "sourceSha256": "20e3b3ec8989478391f8c351684f4697b1865b0cce1f6b155f62529395a26344", - "targetSha256": "20e3b3ec8989478391f8c351684f4697b1865b0cce1f6b155f62529395a26344" - }, - { - "sourcePath": "/items/38/content/items/9/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "0acd8c2aa4ba1955856bf9c4c749ddee5d172f2f6d549331427e5e7ea4978fd6" - }, - "conversion": { - "sourceId": "/items/38/content/items/9/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query shows Microsoft Teams user (false negative) message submissions by the triage verdict assigned during grading (for example Phishing, NotSpam, Spam).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend TriageVerdict = tostring(parse_json(tostring(RD.GradingResult)).TriageVerdict)\r\n| where isnotempty(TriageVerdict)\r\n| summarize Count = count() by TriageVerdict", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/38/content/items/9/content/query", - "sourceSha256": "0acd8c2aa4ba1955856bf9c4c749ddee5d172f2f6d549331427e5e7ea4978fd6", - "targetSha256": "0acd8c2aa4ba1955856bf9c4c749ddee5d172f2f6d549331427e5e7ea4978fd6" - }, - { - "sourcePath": "/items/38/content/items/12/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "04d009f7216f66a76abb64250089d8989722f096714424cc35cb7b9e3c1590bf" - }, - "conversion": { - "sourceId": "/items/38/content/items/12/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists the top 10 P2 (envelope) sender domains of Microsoft Teams messages reported by users as false negatives (missed detections).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend P2SenderDomain = tostring(RD.P2SenderDomain)\r\n| where isnotempty(P2SenderDomain)\r\n| summarize Submissions = count() by ['P2 Sender Domain']=P2SenderDomain\r\n| top 10 by Submissions", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/38/content/items/12/content/query", - "sourceSha256": "04d009f7216f66a76abb64250089d8989722f096714424cc35cb7b9e3c1590bf", - "targetSha256": "04d009f7216f66a76abb64250089d8989722f096714424cc35cb7b9e3c1590bf" - }, - { - "sourcePath": "/items/38/content/items/13/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "d9fc4429458d6768986d75534c7e5b287febb131f98df1013b36157ec0453cdf" - }, - "conversion": { - "sourceId": "/items/38/content/items/13/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists the top 10 individual P2 (envelope) senders of Microsoft Teams messages reported by users as false negatives (missed detections).\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend P2Sender = tostring(RD.P2Sender)\r\n| where isnotempty(P2Sender)\r\n| summarize Submissions = count() by ['P2 Sender']=P2Sender\r\n| top 10 by Submissions", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/38/content/items/13/content/query", - "sourceSha256": "d9fc4429458d6768986d75534c7e5b287febb131f98df1013b36157ec0453cdf", - "targetSha256": "d9fc4429458d6768986d75534c7e5b287febb131f98df1013b36157ec0453cdf" - }, - { - "sourcePath": "/items/38/content/items/16/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "2b779b661ef05861dc698417ce4c3ace11bf5e24c7112b669570d79957640189" - }, - "conversion": { - "sourceId": "/items/38/content/items/16/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists the top 10 users who reported the most Microsoft Teams messages as false negatives (missed detections), with each submitter's email (from the submission record) to disambiguate users with similar names.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"UserSubmission\"\r\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterEmail = tostring(RD.UserId)\r\n| where isnotempty(Submitter) and SubmitterEmail has \"@\"\r\n| summarize Submissions = count() by ['Submitter']=Submitter, ['Email']=SubmitterEmail\r\n| top 10 by Submissions", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/38/content/items/16/content/query", - "sourceSha256": "2b779b661ef05861dc698417ce4c3ace11bf5e24c7112b669570d79957640189", - "targetSha256": "2b779b661ef05861dc698417ce4c3ace11bf5e24c7112b669570d79957640189" - }, - { - "sourcePath": "/items/38/content/items/17/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "97fd2970619fa0b5a172a616deaa5a9f27f21eab634de028226e1114c1adfefa" - }, - "conversion": { - "sourceId": "/items/38/content/items/17/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists the top 10 admins who submitted the most Microsoft Teams messages as false negatives (missed detections). The admin's own email is not present in the submission record (that would require the Identity table), so the Submitter ID (object GUID) is shown to disambiguate admins with similar names.\r\nCloudAppEvents\r\n| extend RD = parse_json(RawEventData)\r\n| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)\r\n| where RecordType == \"29\" and SubmissionContentType == \"ChatMessage\"| where ActionType startswith \"AdminSubmission\"\r\n| extend Submitter = tostring(RD.SubmitterDisplayName), SubmitterId = tostring(RD.SubmitterId)\r\n| where isnotempty(Submitter)\r\n| summarize Submissions = count() by ['Admin']=Submitter, ['Submitter ID']=SubmitterId\r\n| top 10 by Submissions", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/38/content/items/17/content/query", - "sourceSha256": "97fd2970619fa0b5a172a616deaa5a9f27f21eab634de028226e1114c1adfefa", - "targetSha256": "97fd2970619fa0b5a172a616deaa5a9f27f21eab634de028226e1114c1adfefa" - }, - { - "sourcePath": "/items/39/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "0fb110cc01724b5f264e5aaa5c0a3e6b4be6050260a6e29a9a0d2c7fe21ed919" - }, - "conversion": { - "sourceId": "/items/39/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists the 10 most recent Microsoft Teams messages detected as phishing by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Phish\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", - "resolvedTables": [ - "MessageEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/39/content/items/2/content/query", - "sourceSha256": "0fb110cc01724b5f264e5aaa5c0a3e6b4be6050260a6e29a9a0d2c7fe21ed919", - "targetSha256": "0fb110cc01724b5f264e5aaa5c0a3e6b4be6050260a6e29a9a0d2c7fe21ed919" - }, - { - "sourcePath": "/items/39/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "4b9639f39ccb32743e168a2b1d02e8703a134387a8f8e80a368b383c8f831333" - }, - "conversion": { - "sourceId": "/items/39/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists the 10 most recent Microsoft Teams messages detected as malware by Microsoft Defender for Office 365, de-duplicated to the latest record per message. TeamsMessageId is included so analysts can pivot to Advanced Hunting.\r\nMessageEvents\r\n| where ThreatTypes has \"Malware\"\r\n| summarize arg_max(Timestamp, *) by TeamsMessageId\r\n| top 10 by Timestamp desc\r\n| project ['Time']=Timestamp, ['Sender']=SenderEmailAddress, ['Threat Types']=ThreatTypes, ['Delivery Action']=DeliveryAction, ['Safety Tip']=SafetyTip, ['Team / Group']=GroupName, ['External Thread']=IsExternalThread, ['Subject']=MessageSubject, TeamsMessageId", - "resolvedTables": [ - "MessageEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "MessageEvents", - "ahTable": "MessageEvents", - "identical": null, - "columnRenames": {}, - "note": "no cached schema for either side; catalog renames only" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/39/content/items/4/content/query", - "sourceSha256": "4b9639f39ccb32743e168a2b1d02e8703a134387a8f8e80a368b383c8f831333", - "targetSha256": "4b9639f39ccb32743e168a2b1d02e8703a134387a8f8e80a368b383c8f831333" - }, - { - "sourcePath": "/items/41/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "9d59f8c46ce5618c306f4f088c16dcdfa3d0640dea57a088b167b93dd2a8ea24" - }, - "conversion": { - "sourceId": "/items/41/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// This query visualises the top 10 users that are receiving Spam, Phishing or Malware emails\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection == \"Phish\"),SpamEmailCount = countif(FirstDetection == \"Spam\") by RecipientEmailAddress\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by ThreatEmailCount\r\n| project ['Recipient']=RecipientEmailAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/41/content/items/2/content/query", - "sourceSha256": "9d59f8c46ce5618c306f4f088c16dcdfa3d0640dea57a088b167b93dd2a8ea24", - "targetSha256": "9d59f8c46ce5618c306f4f088c16dcdfa3d0640dea57a088b167b93dd2a8ea24" - }, - { - "sourcePath": "/items/41/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "ac961ffab2badfb22671c80ef61f1487dcf566403fc4dce05933d1e41062b334" - }, - "conversion": { - "sourceId": "/items/41/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// This query visualises the top 10 senders by inbound email sending volume\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection == \"Phish\"),SpamEmailCount = countif(FirstDetection == \"Spam\") by SenderFromAddress\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by TotalEmailCount\r\n| project ['Sender']=SenderFromAddress, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/41/content/items/4/content/query", - "sourceSha256": "ac961ffab2badfb22671c80ef61f1487dcf566403fc4dce05933d1e41062b334", - "targetSha256": "ac961ffab2badfb22671c80ef61f1487dcf566403fc4dce05933d1e41062b334" - }, - { - "sourcePath": "/items/41/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "fceefa84bd5d3373ad7b9ec5550c32752c299351566c94db662127b239a08d89" - }, - "conversion": { - "sourceId": "/items/41/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// This query visualises the top 10 senders by inbound email sending volume\r\nEmailEvents \r\n| where OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\" and EmailDirection ==\"Inbound\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalEmailCount=count(),MalwareEmailCount = countif(FirstDetection == \"Malware\"),PhishEmailCount = countif(FirstDetection == \"Phish\"),SpamEmailCount = countif(FirstDetection == \"Spam\") by SenderFromDomain\r\n| extend ThreatEmailCount=(MalwareEmailCount+PhishEmailCount+SpamEmailCount)\r\n| extend Bad_Traffic_Percentage_Inbound = todouble(round(ThreatEmailCount / todouble(TotalEmailCount) *100, 2))\r\n| top 15 by TotalEmailCount\r\n| project ['Sender Domain']=SenderFromDomain, ['Total Emails']=TotalEmailCount, ['Threat Emails']=ThreatEmailCount, ['Malware']=MalwareEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount, ['Bad Traffic %']=Bad_Traffic_Percentage_Inbound", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/41/content/items/6/content/query", - "sourceSha256": "fceefa84bd5d3373ad7b9ec5550c32752c299351566c94db662127b239a08d89", - "targetSha256": "fceefa84bd5d3373ad7b9ec5550c32752c299351566c94db662127b239a08d89" - }, - { - "sourcePath": "/items/42/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "5e0116bf9f5d0bc3393442882c18bcbcb7c7de3552a08ca36ca34e74b571b4ca" - }, - "conversion": { - "sourceId": "/items/42/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// This query visualises automatic email forwarding to external email addresses by forwarding type\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| summarize count() by ForwardingType\r\n| sort by count_ desc \r\n", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/42/content/items/3/content/query", - "sourceSha256": "5e0116bf9f5d0bc3393442882c18bcbcb7c7de3552a08ca36ca34e74b571b4ca", - "targetSha256": "5e0116bf9f5d0bc3393442882c18bcbcb7c7de3552a08ca36ca34e74b571b4ca" - }, - { - "sourcePath": "/items/42/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "7dbef8b884dd43cc125e9c117b67264abeaae9d61cfd118b9d6716b4651bafad" - }, - "conversion": { - "sourceId": "/items/42/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| summarize TotalForwardedMessages = count() by ForwardingUser\r\n| sort by TotalForwardedMessages desc \r\n| top 10 by TotalForwardedMessages\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages\r\n\r\n", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/42/content/items/4/content/query", - "sourceSha256": "7dbef8b884dd43cc125e9c117b67264abeaae9d61cfd118b9d6716b4651bafad", - "targetSha256": "7dbef8b884dd43cc125e9c117b67264abeaae9d61cfd118b9d6716b4651bafad" - }, - { - "sourcePath": "/items/42/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "17f3884ff63e526609f3cf6853e35fae3eb67888c3b17c22d44641353f4c1886" - }, - "conversion": { - "sourceId": "/items/42/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by ForwardingUser\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=TotalForwardedMessages", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/42/content/items/6/content/query", - "sourceSha256": "17f3884ff63e526609f3cf6853e35fae3eb67888c3b17c22d44641353f4c1886", - "targetSha256": "17f3884ff63e526609f3cf6853e35fae3eb67888c3b17c22d44641353f4c1886" - }, - { - "sourcePath": "/items/42/content/items/9/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "0051da9da84fd58c4227dfa6801a0fc16a44d77c2e336d0b1aad7995862f15bf" - }, - "conversion": { - "sourceId": "/items/42/content/items/9/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// This query visualises the top 10 external domains who are recieving automatically forwarded emails using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by RecipientDomain\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/42/content/items/9/content/query", - "sourceSha256": "0051da9da84fd58c4227dfa6801a0fc16a44d77c2e336d0b1aad7995862f15bf", - "targetSha256": "0051da9da84fd58c4227dfa6801a0fc16a44d77c2e336d0b1aad7995862f15bf" - }, - { - "sourcePath": "/items/42/content/items/10/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "63f1fbdcafb468c66e1febf1482a7f3463d594eeb4394214aafb0e20b6df5551" - }, - "conversion": { - "sourceId": "/items/42/content/items/10/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using Mailbox Rules\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"MbxRule\"\r\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/42/content/items/10/content/query", - "sourceSha256": "63f1fbdcafb468c66e1febf1482a7f3463d594eeb4394214aafb0e20b6df5551", - "targetSha256": "63f1fbdcafb468c66e1febf1482a7f3463d594eeb4394214aafb0e20b6df5551" - }, - { - "sourcePath": "/items/42/content/items/12/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "7a240719dc0518ec4cd9fbb8458bdba5043dc188e73ccc4079238ff38a3f5ded" - }, - "conversion": { - "sourceId": "/items/42/content/items/12/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// This query visualises the top 10 internal senders who are automatically forwarding emails to external email addresses using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize count() by ForwardingUser\r\n| top 10 by count_ desc\r\n| project ['Forwarding User']=ForwardingUser, ['Forwarded Messages']=count_", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/42/content/items/12/content/query", - "sourceSha256": "7a240719dc0518ec4cd9fbb8458bdba5043dc188e73ccc4079238ff38a3f5ded", - "targetSha256": "7a240719dc0518ec4cd9fbb8458bdba5043dc188e73ccc4079238ff38a3f5ded" - }, - { - "sourcePath": "/items/42/content/items/15/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "f419065f15e2b1933db7f5ad38dcbc907dc999bbe3c10400a02732e1b85ef9e9" - }, - "conversion": { - "sourceId": "/items/42/content/items/15/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser),RecipientDomain = tostring(split(RecipientEmailAddress, \"@\")[1])\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize TotalForwardedMessages = count() by RecipientDomain\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient Domain']=RecipientDomain, ['Forwarded Messages']=TotalForwardedMessages", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/42/content/items/15/content/query", - "sourceSha256": "f419065f15e2b1933db7f5ad38dcbc907dc999bbe3c10400a02732e1b85ef9e9", - "targetSha256": "f419065f15e2b1933db7f5ad38dcbc907dc999bbe3c10400a02732e1b85ef9e9" - }, - { - "sourcePath": "/items/42/content/items/16/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "4e4912f05c0a6b730d36f0571fe9b520d19c6cc77048e7a7d827ac38cde51ece" - }, - "conversion": { - "sourceId": "/items/42/content/items/16/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// This query visualises the top 10 external recipients who are recieving automatically forwarded emails using SmtpForwarding\r\nEmailEvents \r\n| where EmailDirection == \"Outbound\" and ForwardingInformation !=\"\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ForwardingType = tostring((parse_json(ForwardingInformation)).ForwardingType),ForwardingUser=tostring((parse_json(ForwardingInformation)).ForwardingUser)\r\n| where ForwardingType ==\"SmtpForwarding\"\r\n| summarize TotalForwardedMessages = count() by RecipientEmailAddress\r\n| top 10 by TotalForwardedMessages desc\r\n| project ['Recipient']=RecipientEmailAddress, ['Forwarded Messages']=TotalForwardedMessages", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/42/content/items/16/content/query", - "sourceSha256": "4e4912f05c0a6b730d36f0571fe9b520d19c6cc77048e7a7d827ac38cde51ece", - "targetSha256": "4e4912f05c0a6b730d36f0571fe9b520d19c6cc77048e7a7d827ac38cde51ece" - }, - { - "sourcePath": "/items/44/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "98841a54452a812aa4fb1d340d18cc6ad07db86fec6ead416e83493936120eec" - }, - "conversion": { - "sourceId": "/items/44/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the ammount of emails subject to an admin policy with action of allow independent of action taken, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/44/content/items/2/content/query", - "sourceSha256": "98841a54452a812aa4fb1d340d18cc6ad07db86fec6ead416e83493936120eec", - "targetSha256": "98841a54452a812aa4fb1d340d18cc6ad07db86fec6ead416e83493936120eec" - }, - { - "sourcePath": "/items/44/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "08eb36cc6b166e767c0298ceac0436bd7dcd8ee1529950c0900e62f533436c43" - }, - "conversion": { - "sourceId": "/items/44/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/44/content/items/5/content/query", - "sourceSha256": "08eb36cc6b166e767c0298ceac0436bd7dcd8ee1529950c0900e62f533436c43", - "targetSha256": "08eb36cc6b166e767c0298ceac0436bd7dcd8ee1529950c0900e62f533436c43" - }, - { - "sourcePath": "/items/44/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "479581dfceba4451dbdf7519a43485982e518fc2508e7008a552d26c58474d10" - }, - "conversion": { - "sourceId": "/items/44/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the ammount of emails subject to an admin policy with action of allow, independent of action taken, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy!=\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/44/content/items/6/content/query", - "sourceSha256": "479581dfceba4451dbdf7519a43485982e518fc2508e7008a552d26c58474d10", - "targetSha256": "479581dfceba4451dbdf7519a43485982e518fc2508e7008a552d26c58474d10" - }, - { - "sourcePath": "/items/44/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "605f590cbbd6fdc3484113461d66c5d0b477e6bb4bcb108ce19b4a38d770fc97" - }, - "conversion": { - "sourceId": "/items/44/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of emails subject to the \r\nEmailEvents \r\n| where OrgLevelPolicy==\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/44/content/items/8/content/query", - "sourceSha256": "605f590cbbd6fdc3484113461d66c5d0b477e6bb4bcb108ce19b4a38d770fc97", - "targetSha256": "605f590cbbd6fdc3484113461d66c5d0b477e6bb4bcb108ce19b4a38d770fc97" - }, - { - "sourcePath": "/items/44/content/items/9/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "fd049e88fa8087c8310c7c8f5921ae01ae9d30c2f378b8dfc0c987bc882bdc55" - }, - "conversion": { - "sourceId": "/items/44/content/items/9/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the ammount of emails delivered to the SecOps Mailbox by threat type\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelPolicy==\"SecOps Mailbox\" and OrgLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/44/content/items/9/content/query", - "sourceSha256": "fd049e88fa8087c8310c7c8f5921ae01ae9d30c2f378b8dfc0c987bc882bdc55", - "targetSha256": "fd049e88fa8087c8310c7c8f5921ae01ae9d30c2f378b8dfc0c987bc882bdc55" - }, - { - "sourcePath": "/items/45/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "0191481702bf99320c3c3ad445bb2e8a562c98b46d86efa5a17bcf9b1ef9eb94" - }, - "conversion": { - "sourceId": "/items/45/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalAdminOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Admin Overrides'] = coalesce(TotalAdminOverrides, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/45/content/items/2/content/query", - "sourceSha256": "0191481702bf99320c3c3ad445bb2e8a562c98b46d86efa5a17bcf9b1ef9eb94", - "targetSha256": "0191481702bf99320c3c3ad445bb2e8a562c98b46d86efa5a17bcf9b1ef9eb94" - }, - { - "sourcePath": "/items/45/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "01b0947f0335fa298b8afea14dcc5e146680f766523ab941ff94b982afb7d45c" - }, - "conversion": { - "sourceId": "/items/45/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of emails subject to an admin policy with action of block, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by OrgLevelPolicy", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/45/content/items/5/content/query", - "sourceSha256": "01b0947f0335fa298b8afea14dcc5e146680f766523ab941ff94b982afb7d45c", - "targetSha256": "01b0947f0335fa298b8afea14dcc5e146680f766523ab941ff94b982afb7d45c" - }, - { - "sourcePath": "/items/45/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "5308d5b51d6cc5c05ec341e7da32f8f3291d9f0a9c86842f71f9522be78e0d26" - }, - "conversion": { - "sourceId": "/items/45/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the ammount of emails subject to an admin policy with action of block, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(OrgLevelPolicy) and OrgLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by OrgLevelAction,OrgLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/45/content/items/6/content/query", - "sourceSha256": "5308d5b51d6cc5c05ec341e7da32f8f3291d9f0a9c86842f71f9522be78e0d26", - "targetSha256": "5308d5b51d6cc5c05ec341e7da32f8f3291d9f0a9c86842f71f9522be78e0d26" - }, - { - "sourcePath": "/items/46/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "8eb5d94e482fa58347a8ce7121a05ac0d42d087646d610ed7268b982f821a6df" - }, - "conversion": { - "sourceId": "/items/46/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/46/content/items/2/content/query", - "sourceSha256": "8eb5d94e482fa58347a8ce7121a05ac0d42d087646d610ed7268b982f821a6df", - "targetSha256": "8eb5d94e482fa58347a8ce7121a05ac0d42d087646d610ed7268b982f821a6df" - }, - { - "sourcePath": "/items/46/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "634ea17d6cce9c0c9779764b703ddc1cfce8f66aa5d6c9124e913e33f368e4e3" - }, - "conversion": { - "sourceId": "/items/46/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by UserLevelPolicy", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/46/content/items/5/content/query", - "sourceSha256": "634ea17d6cce9c0c9779764b703ddc1cfce8f66aa5d6c9124e913e33f368e4e3", - "targetSha256": "634ea17d6cce9c0c9779764b703ddc1cfce8f66aa5d6c9124e913e33f368e4e3" - }, - { - "sourcePath": "/items/46/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "39177dbcea32c9061429809d0735bb1ff809bc2050b5c20fe60cba294737ba07" - }, - "conversion": { - "sourceId": "/items/46/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the ammount of emails subject to a user type policy with action of allow, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Allow\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/46/content/items/6/content/query", - "sourceSha256": "39177dbcea32c9061429809d0735bb1ff809bc2050b5c20fe60cba294737ba07", - "targetSha256": "39177dbcea32c9061429809d0735bb1ff809bc2050b5c20fe60cba294737ba07" - }, - { - "sourcePath": "/items/47/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "98ae122b7b16d93a3b04c8c4bff31071fe303ddbb0395a629a7c77f0d4094a4e" - }, - "conversion": { - "sourceId": "/items/47/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data daily\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailEvents\r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize TotalUserOverrides = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User Overrides'] = coalesce(TotalUserOverrides, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/47/content/items/2/content/query", - "sourceSha256": "98ae122b7b16d93a3b04c8c4bff31071fe303ddbb0395a629a7c77f0d4094a4e", - "targetSha256": "98ae122b7b16d93a3b04c8c4bff31071fe303ddbb0395a629a7c77f0d4094a4e" - }, - { - "sourcePath": "/items/47/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "038df3e31a9bd7d87478d0db455c54d07eb82935fe7f53a11faaddaefd310858" - }, - "conversion": { - "sourceId": "/items/47/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of emails subject to a user type policy with action of block, summarizing the data by type of override\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize count() by UserLevelPolicy", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/47/content/items/5/content/query", - "sourceSha256": "038df3e31a9bd7d87478d0db455c54d07eb82935fe7f53a11faaddaefd310858", - "targetSha256": "038df3e31a9bd7d87478d0db455c54d07eb82935fe7f53a11faaddaefd310858" - }, - { - "sourcePath": "/items/47/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "11597c350853d749382e4f898978edbdfc528bb6930690b985201cd197737a43" - }, - "conversion": { - "sourceId": "/items/47/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the ammount of emails subject to a user type policy with action of block, summarizing the data by type of override and threats type found\r\nEmailEvents \r\n| where isnotempty(UserLevelPolicy) and UserLevelAction == \"Block\" \r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend ThreatTypes = case(ThreatTypes has \"Malware\", \"Malware\", ThreatTypes has \"Phish\", \"Phish\", ThreatTypes has \"Spam\", \"Spam\", ThreatTypes)\r\n| summarize TotalEmails=count() by UserLevelAction,UserLevelPolicy,ThreatTypes\r\n| sort by TotalEmails\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Total Emails']=TotalEmails", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/47/content/items/6/content/query", - "sourceSha256": "11597c350853d749382e4f898978edbdfc528bb6930690b985201cd197737a43", - "targetSha256": "11597c350853d749382e4f898978edbdfc528bb6930690b985201cd197737a43" - }, - { - "sourcePath": "/items/48/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "dab1d4deeaa36005a3c935359196c47841107592a702f815bfca3087aecfa108" - }, - "conversion": { - "sourceId": "/items/48/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Top recipients receiving threats that were delivered due to an admin or user override, with the share of their threats that were overridden and a breakdown of which override types caused them.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend OverrideType = case(\r\n OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\r\n UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\r\n \"(none)\")\r\n| summarize PerType = count() by RecipientEmailAddress, OverrideType\r\n| summarize TotalThreats = sum(PerType),\r\n OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\r\n OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\r\n by RecipientEmailAddress\r\n| where OverriddenThreats > 0\r\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\r\n| top 15 by OverriddenThreats\r\n| project ['Recipient']=RecipientEmailAddress, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/48/content/items/1/content/query", - "sourceSha256": "dab1d4deeaa36005a3c935359196c47841107592a702f815bfca3087aecfa108", - "targetSha256": "dab1d4deeaa36005a3c935359196c47841107592a702f815bfca3087aecfa108" - }, - { - "sourcePath": "/items/48/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "cfe62517a4c1056dead45ef4655eb3a7bd13844272f2e92522e92c06be146eed" - }, - "conversion": { - "sourceId": "/items/48/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Top sender domains sending threats to users, with the share of those threats that were delivered because of an admin or user override and a breakdown of which override types caused them. High override rates are strong candidates for policy review or a Tenant Allow/Block List (TABL) block.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and OrgLevelPolicy != \"Phishing simulation\" and OrgLevelPolicy != \"SecOps Mailbox\"\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| extend OverrideType = case(\r\n OrgLevelAction == \"Allow\" and OrgLevelPolicy != \"\" and OrgLevelPolicy != \"SecOps Mailbox\", OrgLevelPolicy,\r\n UserLevelAction == \"Allow\", strcat(\"User: \", UserLevelPolicy),\r\n \"(none)\")\r\n| summarize PerType = count() by SenderFromDomain, OverrideType\r\n| summarize TotalThreats = sum(PerType),\r\n OverriddenThreats = sumif(PerType, OverrideType != \"(none)\"),\r\n OverrideTypes = strcat_array(make_set_if(strcat(OverrideType, \" (\", PerType, \")\"), OverrideType != \"(none)\"), \"; \")\r\n by SenderFromDomain\r\n| where OverriddenThreats > 0\r\n| extend OverridePercent = round(OverriddenThreats * 100.0 / TotalThreats, 1)\r\n| top 10 by OverriddenThreats\r\n| project ['Sender Domain']=SenderFromDomain, ['Total Threats']=TotalThreats, ['Overridden Threats']=OverriddenThreats, ['Override %']=OverridePercent, ['Override Types']=OverrideTypes", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/48/content/items/2/content/query", - "sourceSha256": "cfe62517a4c1056dead45ef4655eb3a7bd13844272f2e92522e92c06be146eed", - "targetSha256": "cfe62517a4c1056dead45ef4655eb3a7bd13844272f2e92522e92c06be146eed" - }, - { - "sourcePath": "/items/50/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "6020e0927daa1fef5e01740cf193e8b6b53be2df55ce4d097d1b9e9af8fe5603" - }, - "conversion": { - "sourceId": "/items/50/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the daily ammount of admin false negative submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize Admin_Malware_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Phish_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Spam_FN=countif(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_Malware_URL_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Malware_Attach_FN=countif(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\"), Admin_Phish_URL_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Phish_Attach_FN=countif(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Malware (Mail)']=coalesce(Admin_Malware_FN,0), ['Phish (Mail)']=coalesce(Admin_Phish_FN,0), ['Spam (Mail)']=coalesce(Admin_Spam_FN,0), ['Malware (URL)']=coalesce(Admin_Malware_URL_FN,0), ['Malware (Attachment)']=coalesce(Admin_Malware_Attach_FN,0), ['Phish (URL)']=coalesce(Admin_Phish_URL_FN,0), ['Phish (Attachment)']=coalesce(Admin_Phish_Attach_FN,0) | sort by Timestamp asc", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/50/content/items/2/content/query", - "sourceSha256": "6020e0927daa1fef5e01740cf193e8b6b53be2df55ce4d097d1b9e9af8fe5603", - "targetSha256": "6020e0927daa1fef5e01740cf193e8b6b53be2df55ce4d097d1b9e9af8fe5603" - }, - { - "sourcePath": "/items/50/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "07335ac977d13181fb7d411d158bfab30b680d3644e16c8211f384e3413e14a9" - }, - "conversion": { - "sourceId": "/items/50/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of admin false negative submission by submission type.\r\nCloudAppEvents \r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Malware (Mail)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Malware (URL)\",\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Malware (Attachment)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"Phish (URL)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Phish (Attachment)\",\r\n\"Other\")))))))\r\n| where Admin_SubmissionType!=\"Other\"\r\n| summarize count() by Admin_SubmissionType", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/50/content/items/5/content/query", - "sourceSha256": "07335ac977d13181fb7d411d158bfab30b680d3644e16c8211f384e3413e14a9", - "targetSha256": "07335ac977d13181fb7d411d158bfab30b680d3644e16c8211f384e3413e14a9" - }, - { - "sourcePath": "/items/50/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "ae9cfa969dc3fa98eecab3e33895123d8ebe2e0ea45d848719aa31ccee2930e5" - }, - "conversion": { - "sourceId": "/items/50/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of admin false negative submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\r\n| summarize count() by tostring(SubmissionState)", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/50/content/items/6/content/query", - "sourceSha256": "ae9cfa969dc3fa98eecab3e33895123d8ebe2e0ea45d848719aa31ccee2930e5", - "targetSha256": "ae9cfa969dc3fa98eecab3e33895123d8ebe2e0ea45d848719aa31ccee2930e5" - }, - { - "sourcePath": "/items/50/content/items/9/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "c117a2d84bd97df6b74b225278f0777be5c7fc23787241ed897c31080ddccf20" - }, - "conversion": { - "sourceId": "/items/50/content/items/9/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of admin false negative or false positive submissions by the verdict of the submission grading.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmissionTriage\" \r\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState, SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \r\n| summarize count() by tostring(TriageVerdict)", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/50/content/items/9/content/query", - "sourceSha256": "c117a2d84bd97df6b74b225278f0777be5c7fc23787241ed897c31080ddccf20", - "targetSha256": "c117a2d84bd97df6b74b225278f0777be5c7fc23787241ed897c31080ddccf20" - }, - { - "sourcePath": "/items/50/content/items/10/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "d5c27998417b90d3c5b0a62e92cb1ec067b53953072483c45c3702ea26d0128f" - }, - "conversion": { - "sourceId": "/items/50/content/items/10/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the top admins performing false negative submissions\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType \r\n| where Record == 29 and SubmissionType in (\"0\",\"1\",\"2\")\r\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/50/content/items/10/content/query", - "sourceSha256": "d5c27998417b90d3c5b0a62e92cb1ec067b53953072483c45c3702ea26d0128f", - "targetSha256": "d5c27998417b90d3c5b0a62e92cb1ec067b53953072483c45c3702ea26d0128f" - }, - { - "sourcePath": "/items/50/content/items/12/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "1cdb86b390d21c72e50df9d4bf8b62fe908de31edb727f5e9a63b5f4917a9f4b" - }, - "conversion": { - "sourceId": "/items/50/content/items/12/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Top 10 sender domains that admins reported false negatives (missed threats) for, with each domain's MDO-detected threat profile for context.\r\nlet subs = CloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType), SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\")\r\n| summarize AdminSubmissions=count() by P2SenderDomain;\r\nlet domainProfile = EmailEvents\r\n| where EmailDirection == \"Inbound\"\r\n| summarize TotalInbound=count(), EmailsWithThreats=countif(isnotempty(ThreatTypes)), Malware=countif(ThreatTypes has \"Malware\"), Phish=countif(ThreatTypes has \"Phish\"), Spam=countif(ThreatTypes has \"Spam\") by SenderFromDomain;\r\nsubs\r\n| join kind=leftouter (domainProfile) on $left.P2SenderDomain == $right.SenderFromDomain\r\n| extend AdminSubmissionPct = round(AdminSubmissions * 100.0 / todouble(coalesce(TotalInbound, AdminSubmissions)), 2)\r\n| top 10 by AdminSubmissions desc\r\n| project ['Sender Domain']=P2SenderDomain, ['Emails With Threats']=coalesce(EmailsWithThreats,0), ['Malware']=coalesce(Malware,0), ['Phish']=coalesce(Phish,0), ['Spam']=coalesce(Spam,0), ['Admin Submissions']=AdminSubmissions, ['Admin Submission %']=AdminSubmissionPct", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/50/content/items/12/content/query", - "sourceSha256": "1cdb86b390d21c72e50df9d4bf8b62fe908de31edb727f5e9a63b5f4917a9f4b", - "targetSha256": "1cdb86b390d21c72e50df9d4bf8b62fe908de31edb727f5e9a63b5f4917a9f4b" - }, - { - "sourcePath": "/items/50/content/items/14/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "747ee111c8ee30f787f5d503bfcead7f08e4c84dbc62cc750e1dddae76ee1f70" - }, - "conversion": { - "sourceId": "/items/50/content/items/14/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises emails submitted as false negatives by admins where emails where already detected by MDO but there was a admin policy override\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"2\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Malware (Mail)\",\r\niff(SubmissionType == \"1\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\"))),\r\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"2\",\"1\",\"0\") and PolicyOverride !=\"NoOverride\"\r\n| summarize count() by PolicyOverride, PolicyPolicyOverrideType,DetectionVerdict,Admin_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Policy Override']=PolicyOverride, ['Override Source']=PolicyPolicyOverrideType, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/50/content/items/14/content/query", - "sourceSha256": "747ee111c8ee30f787f5d503bfcead7f08e4c84dbc62cc750e1dddae76ee1f70", - "targetSha256": "747ee111c8ee30f787f5d503bfcead7f08e4c84dbc62cc750e1dddae76ee1f70" - }, - { - "sourcePath": "/items/51/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "190c560e0a844d97439beaa78531501c980cbc57205552ed4d3aa74a75432544" - }, - "conversion": { - "sourceId": "/items/51/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the daily ammount of users false negative submission by submission type, including phish simulations reported by users.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize User_Phish_FN=countif(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"), User_Spam_FN=countif(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"), User_AttackSim_Submission=countif(ActionType == \"AttackSimUserSubmission\" and SubmissionContentType==\"Mail\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Phish (Mail)']=coalesce(User_Phish_FN,0), ['Spam (Mail)']=coalesce(User_Spam_FN,0), ['Attack simulation reported']=coalesce(User_AttackSim_Submission,0) | sort by Timestamp asc", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/51/content/items/2/content/query", - "sourceSha256": "190c560e0a844d97439beaa78531501c980cbc57205552ed4d3aa74a75432544", - "targetSha256": "190c560e0a844d97439beaa78531501c980cbc57205552ed4d3aa74a75432544" - }, - { - "sourcePath": "/items/51/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "4ec67e14891fb4eaee26027655c919bee250246646f01f91837f1d93fcf5b17a" - }, - "conversion": { - "sourceId": "/items/51/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of user false negative submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\")\r\n| summarize count() by tostring(SubmissionState)", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/51/content/items/5/content/query", - "sourceSha256": "4ec67e14891fb4eaee26027655c919bee250246646f01f91837f1d93fcf5b17a", - "targetSha256": "4ec67e14891fb4eaee26027655c919bee250246646f01f91837f1d93fcf5b17a" - }, - { - "sourcePath": "/items/51/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "bbbfd512ecfb4772f33fb2eda6f71e470f9a2e5e6c6d87a727113a0d863b8e53" - }, - "conversion": { - "sourceId": "/items/51/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmissionTriage\" \r\n| extend UserKey = (parse_json(RawEventData)).UserKey, SubmissionState = (parse_json(RawEventData)).SubmissionState, SubmissionId=(parse_json(RawEventData)).SubmissionId, TriageVerdict=(parse_json(RawEventData)).GradingResult.TriageVerdict \r\n| summarize count() by tostring(TriageVerdict)", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/51/content/items/6/content/query", - "sourceSha256": "bbbfd512ecfb4772f33fb2eda6f71e470f9a2e5e6c6d87a727113a0d863b8e53", - "targetSha256": "bbbfd512ecfb4772f33fb2eda6f71e470f9a2e5e6c6d87a727113a0d863b8e53" - }, - { - "sourcePath": "/items/51/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "17b36c25f276a7ff82978008d44a8988234315b3d3762b20f04960e92adafd3f" - }, - "conversion": { - "sourceId": "/items/51/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where DeliveryLocation == \"Junk folder\"\r\n| summarize count() by ThreatTypes,User_SubmissionType\r\n| project ThreatTypes,User_SubmissionType, Emails = count_", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/51/content/items/8/content/query", - "sourceSha256": "17b36c25f276a7ff82978008d44a8988234315b3d3762b20f04960e92adafd3f", - "targetSha256": "17b36c25f276a7ff82978008d44a8988234315b3d3762b20f04960e92adafd3f" - }, - { - "sourcePath": "/items/51/content/items/9/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "87241ae8c69a092670d36b458c788b767ceb248dfa85cc4bf364e80f6eb9757d" - }, - "conversion": { - "sourceId": "/items/51/content/items/9/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of user false negative submissions that are already detected by MDO and already delivered in the junk folder\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId,UserId = (parse_json(RawEventData)).UserId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where DeliveryLocation == \"Junk folder\"\r\n| extend MDO_detection = parse_json(DetectionMethods) \r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0])) \r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\") \r\n| summarize TotalJunkSubmittedEmailCount=count(),PhishEmailCount = countif(FirstDetection == \"Phish\"),SpamEmailCount = countif(FirstDetection == \"Spam\") by tostring(UserId)\r\n| top 15 by TotalJunkSubmittedEmailCount desc\r\n| project ['User']=UserId, ['Junk Submissions']=TotalJunkSubmittedEmailCount, ['Phish']=PhishEmailCount, ['Spam']=SpamEmailCount", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/51/content/items/9/content/query", - "sourceSha256": "87241ae8c69a092670d36b458c788b767ceb248dfa85cc4bf364e80f6eb9757d", - "targetSha256": "87241ae8c69a092670d36b458c788b767ceb248dfa85cc4bf364e80f6eb9757d" - }, - { - "sourcePath": "/items/51/content/items/12/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "7bca4d4dd4db1c3c3789edf2817216821aa859846d5291dac6f29c0cce09a15d" - }, - "conversion": { - "sourceId": "/items/51/content/items/12/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises user submissions where admin also performed 'mark and notify' action on the submission\r\nlet ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\r\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\r\n| mv-expand element = Properties\r\n| where element.Name == \"AdminReviewResult\"\r\n| project SubmissionId, AdminReviewResult = element.Value;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\r\n| join kind=leftouter ReviewResults on SubmissionId\r\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\r\n| extend ReviewedAccuracy=iif(UserReportedAs==AdminReviewResult, 1,0)\r\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\r\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\r\n| summarize count() by Reviewed", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/51/content/items/12/content/query", - "sourceSha256": "7bca4d4dd4db1c3c3789edf2817216821aa859846d5291dac6f29c0cce09a15d", - "targetSha256": "7bca4d4dd4db1c3c3789edf2817216821aa859846d5291dac6f29c0cce09a15d" - }, - { - "sourcePath": "/items/51/content/items/13/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "0a164920cbdf7d1d27cb8a5e2753d3e3ba1565f10f2476c9daf3732e7f4e51ca" - }, - "conversion": { - "sourceId": "/items/51/content/items/13/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises user submissions type compared to admin review verdict. \r\n//Eg. User reporting a phish but admin review is 'not threat found'\r\nlet ReviewResults = CloudAppEvents | where ActionType == \"SubmissionNotification\" \r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId)\r\n| extend Properties = parse_json(RawEventData.ExtendedProperties)\r\n| mv-expand element = Properties\r\n| where element.Name == \"AdminReviewResult\"\r\n| project SubmissionId, AdminReviewResult = element.Value;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionId = tostring(parse_json(RawEventData).SubmissionId), SubmissionType = parse_json(RawEventData).SubmissionType\r\n| join kind=leftouter ReviewResults on SubmissionId\r\n| extend UserReportedAs=iif(SubmissionType == 1, \"Phish\",iif(SubmissionType == 2, \"Junk\",iif(SubmissionType == 3, \"NotJunk\",\"\")))\r\n| extend ReviewedAccuracy=iif(AdminReviewResult==UserReportedAs, \"Correct\", iif(AdminReviewResult==\"Phish\" and UserReportedAs == \"Junk\", \"Phish reported as junk\",iif(AdminReviewResult==\"Junk\" and UserReportedAs == \"Phish\",\"Junk reported as Phish\",iif(AdminReviewResult==\"NotJunk\",\"Reported but not malicious or spam\",iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Not correct\")))))\r\n| extend Reviewed=iif(isempty(AdminReviewResult),\"Not Reviewed\",\"Reviewed\")\r\n| project SubmissionId,UserReportedAs,Reviewed,AdminReviewResult, ReviewedAccuracy\r\n| where Reviewed==\"Reviewed\"\r\n| summarize count() by ReviewedAccuracy", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/51/content/items/13/content/query", - "sourceSha256": "0a164920cbdf7d1d27cb8a5e2753d3e3ba1565f10f2476c9daf3732e7f4e51ca", - "targetSha256": "0a164920cbdf7d1d27cb8a5e2753d3e3ba1565f10f2476c9daf3732e7f4e51ca" - }, - { - "sourcePath": "/items/51/content/items/15/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "2ff628e131399a7d636349ebdd421d29f7a21434c2690d04e68577c870b425ed" - }, - "conversion": { - "sourceId": "/items/51/content/items/15/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises top 10 sender domains of inbound emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Inbound\"\r\n| summarize count() by SenderFromDomain;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize UserSubmissions=count() by SenderFromDomain\r\n| join TotalInboundbySender on SenderFromDomain\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Domain']=SenderFromDomain, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/51/content/items/15/content/query", - "sourceSha256": "2ff628e131399a7d636349ebdd421d29f7a21434c2690d04e68577c870b425ed", - "targetSha256": "2ff628e131399a7d636349ebdd421d29f7a21434c2690d04e68577c870b425ed" - }, - { - "sourcePath": "/items/51/content/items/17/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "5a3bd5ba09ef5bdeb326e9c37633cca5ab76566d5e0023bdbca7ba8ba22b9ed2" - }, - "conversion": { - "sourceId": "/items/51/content/items/17/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises top 10 sender email addresses of inbound emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Inbound\"\r\n| summarize count() by SenderFromAddress;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize UserSubmissions=count() by SenderFromAddress\r\n| join TotalInboundbySender on SenderFromAddress\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Inbound']=count_, ['User Submission %']=UserSubmissions_Percentage", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/51/content/items/17/content/query", - "sourceSha256": "5a3bd5ba09ef5bdeb326e9c37633cca5ab76566d5e0023bdbca7ba8ba22b9ed2", - "targetSha256": "5a3bd5ba09ef5bdeb326e9c37633cca5ab76566d5e0023bdbca7ba8ba22b9ed2" - }, - { - "sourcePath": "/items/51/content/items/19/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "4242a874bb7bfd3b4571641f2f448a2cfabd00415c8cdb14a2da887b60e8c94d" - }, - "conversion": { - "sourceId": "/items/51/content/items/19/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises top 10 sender email address of intra-org emails submitted as false negatives by users.\r\nlet TotalInboundbySender=\r\nEmailEvents\r\n| where EmailDirection ==\"Intra-org\"\r\n| summarize count() by SenderFromAddress;\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),RecipientObjectId=AccountObjectId,NetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize UserSubmissions=count() by SenderFromAddress\r\n| join TotalInboundbySender on SenderFromAddress\r\n| extend UserSubmissions_Percentage = todouble(round(UserSubmissions / todouble(count_) * 100, 2))\r\n| top 10 by UserSubmissions desc\r\n| project ['Sender Address']=SenderFromAddress, ['User Submissions']=UserSubmissions, ['Total Intra-org']=count_, ['User Submission %']=UserSubmissions_Percentage", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/51/content/items/19/content/query", - "sourceSha256": "4242a874bb7bfd3b4571641f2f448a2cfabd00415c8cdb14a2da887b60e8c94d", - "targetSha256": "4242a874bb7bfd3b4571641f2f448a2cfabd00415c8cdb14a2da887b60e8c94d" - }, - { - "sourcePath": "/items/51/content/items/21/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "076baa0f569360603bcad7368056a253218abf225d4fa285b14ac64612a7793d" - }, - "conversion": { - "sourceId": "/items/51/content/items/21/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises top 10 subjects of intra-org emails submitted as false negatives by users.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize count() by Subject\r\n| top 10 by count_ desc\r\n| project ['Subject']=Subject, ['User Submissions']=count_", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/51/content/items/21/content/query", - "sourceSha256": "076baa0f569360603bcad7368056a253218abf225d4fa285b14ac64612a7793d", - "targetSha256": "076baa0f569360603bcad7368056a253218abf225d4fa285b14ac64612a7793d" - }, - { - "sourcePath": "/items/51/content/items/23/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "a64a3faaafc023d58d21107ed15f6257956f5c6120e99ca38ec9259db46d029f" - }, - "conversion": { - "sourceId": "/items/51/content/items/23/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an admin definded policy override.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where ThreatTypes !=\"\"and OrgLevelAction!=\"\"\r\n| summarize count() by OrgLevelAction, OrgLevelPolicy,ThreatTypes,User_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Override Action']=OrgLevelAction, ['Override Policy']=OrgLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/51/content/items/23/content/query", - "sourceSha256": "a64a3faaafc023d58d21107ed15f6257956f5c6120e99ca38ec9259db46d029f", - "targetSha256": "a64a3faaafc023d58d21107ed15f6257956f5c6120e99ca38ec9259db46d029f" - }, - { - "sourcePath": "/items/51/content/items/25/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "dc2fe8fc6f590d33ed0ddb60662f0fb9b243333bfecd10a332b96772a03ee33c" - }, - "conversion": { - "sourceId": "/items/51/content/items/25/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises emails submitted as false negatives by users where emails where already detected by MDO but there was an policy override.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType), RecipientObjectId=AccountObjectId\r\n| extend User_SubmissionType=\r\niff(SubmissionType == \"1\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Phish (Mail)\",\r\niff(SubmissionType == \"0\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\",\"Spam (Mail)\",\"Other\")),\r\nNetworkMessageId=tostring((parse_json(RawEventData).ObjectId))\r\n| where SubmissionContentType == \"Mail\" and SubmissionType in (\"1\",\"0\")\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where ThreatTypes !=\"\"and UserLevelAction!=\"\"\r\n| summarize count() by UserLevelAction, UserLevelPolicy,ThreatTypes,User_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Override Action']=UserLevelAction, ['Override Policy']=UserLevelPolicy, ['Threat Type']=ThreatTypes, ['Submission Type']=User_SubmissionType, ['User Submissions']=count_", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/51/content/items/25/content/query", - "sourceSha256": "dc2fe8fc6f590d33ed0ddb60662f0fb9b243333bfecd10a332b96772a03ee33c", - "targetSha256": "dc2fe8fc6f590d33ed0ddb60662f0fb9b243333bfecd10a332b96772a03ee33c" - }, - { - "sourcePath": "/items/51/content/items/27/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "ce551d10e6dee3b5d32931fbe168fbc33bdd09db68897a54df679c31dd10ab25" - }, - "conversion": { - "sourceId": "/items/51/content/items/27/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the top 10 users performing false negative submissions\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType in (\"0\",\"1\")\r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 10 by ['Submissions'] desc", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/51/content/items/27/content/query", - "sourceSha256": "ce551d10e6dee3b5d32931fbe168fbc33bdd09db68897a54df679c31dd10ab25", - "targetSha256": "ce551d10e6dee3b5d32931fbe168fbc33bdd09db68897a54df679c31dd10ab25" - }, - { - "sourcePath": "/items/51/content/items/29/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "2435d71ca693e67251e18f93be23b59a6e745fe1ab1559e8ce1cbaae6aa797a2" - }, - "conversion": { - "sourceId": "/items/51/content/items/29/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the top users reporting the phishing simulation emails.\r\nCloudAppEvents \r\n| extend Record= (parse_json(RawEventData)).RecordType \r\n| extend SubmissionState = (parse_json(RawEventData)).SubmissionState \r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| where Record == 29\r\n| where ActionType == \"AttackSimUserSubmission\" \r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 10 by ['Submissions'] desc", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/51/content/items/29/content/query", - "sourceSha256": "2435d71ca693e67251e18f93be23b59a6e745fe1ab1559e8ce1cbaae6aa797a2", - "targetSha256": "2435d71ca693e67251e18f93be23b59a6e745fe1ab1559e8ce1cbaae6aa797a2" - }, - { - "sourcePath": "/items/53/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "1ec8d0bdae64ae23b8670d90f62e063d73e0a031c151d4f3f9881998ee3b677e" - }, - "conversion": { - "sourceId": "/items/53/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the daily ammount of admin false positive submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| summarize Admin_Email_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\"), Admin_URL_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\"), Admin_Attach_FP=countif(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\") by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Email']=coalesce(Admin_Email_FP,0), ['URL']=coalesce(Admin_URL_FP,0), ['Attachment']=coalesce(Admin_Attach_FP,0) | sort by Timestamp asc", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/53/content/items/2/content/query", - "sourceSha256": "1ec8d0bdae64ae23b8670d90f62e063d73e0a031c151d4f3f9881998ee3b677e", - "targetSha256": "1ec8d0bdae64ae23b8670d90f62e063d73e0a031c151d4f3f9881998ee3b677e" - }, - { - "sourcePath": "/items/53/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "84ff7dba1257d1b322d0a5fcb61924e0e174fd65efd56c5b916de7f53ef8a1c1" - }, - "conversion": { - "sourceId": "/items/53/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of admin false positive submission by submission type.\r\nCloudAppEvents \r\n| where ActionType contains \"Submission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\",\"Email\",\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"URL\",\"URL\",\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Attachment\",\"Attachment\",\r\n\"Other\")))\r\n| where Admin_SubmissionType!=\"Other\"\r\n| summarize count() by Admin_SubmissionType", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/53/content/items/3/content/query", - "sourceSha256": "84ff7dba1257d1b322d0a5fcb61924e0e174fd65efd56c5b916de7f53ef8a1c1", - "targetSha256": "84ff7dba1257d1b322d0a5fcb61924e0e174fd65efd56c5b916de7f53ef8a1c1" - }, - { - "sourcePath": "/items/53/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "a127712060a9efb1387daff4836de6b7b66b5b366fa16c37da5d5145c0241908" - }, - "conversion": { - "sourceId": "/items/53/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of admin false positive submissions by the state of the submission.\r\nCloudAppEvents \r\n| where ActionType contains \"AdminSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| summarize count() by tostring(SubmissionState)", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/53/content/items/6/content/query", - "sourceSha256": "a127712060a9efb1387daff4836de6b7b66b5b366fa16c37da5d5145c0241908", - "targetSha256": "a127712060a9efb1387daff4836de6b7b66b5b366fa16c37da5d5145c0241908" - }, - { - "sourcePath": "/items/53/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "e47978375215d7dd1f8eab2a73be26e59388ded6590c4d3e051fa81fb53b4076" - }, - "conversion": { - "sourceId": "/items/53/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the top admins performing false positive submissions.\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend Record= (parse_json(RawEventData)).RecordType,SubmissionState = (parse_json(RawEventData)).SubmissionState, UserId = (parse_json(RawEventData)).UserId,SubmissionType = parse_json(RawEventData).SubmissionType \r\n| where Record == 29 and SubmissionType ==\"3\"\r\n| summarize ['Submissions']=count() by ['Admin']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/53/content/items/7/content/query", - "sourceSha256": "e47978375215d7dd1f8eab2a73be26e59388ded6590c4d3e051fa81fb53b4076", - "targetSha256": "e47978375215d7dd1f8eab2a73be26e59388ded6590c4d3e051fa81fb53b4076" - }, - { - "sourcePath": "/items/53/content/items/9/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "4e0eebac5a1e8e0252ddc22b1f32bbb64c350e4bd68c5be2f2b372eb332793eb" - }, - "conversion": { - "sourceId": "/items/53/content/items/9/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Admin false positive submissions whose original verdict was Malware, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Malware.\r\nlet total = toscalar(CloudAppEvents\r\n | where ActionType == \"AdminSubmissionSubmitted\"\r\n | extend R = parse_json(RawEventData)\r\n | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Malware\"\r\n | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Malware\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Malware FPs'] = Pct", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/53/content/items/9/content/query", - "sourceSha256": "4e0eebac5a1e8e0252ddc22b1f32bbb64c350e4bd68c5be2f2b372eb332793eb", - "targetSha256": "4e0eebac5a1e8e0252ddc22b1f32bbb64c350e4bd68c5be2f2b372eb332793eb" - }, - { - "sourcePath": "/items/53/content/items/11/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "942f49b9d76b441e429e52472521cf70bea50866823f8deeed6b466b36bfc6cd" - }, - "conversion": { - "sourceId": "/items/53/content/items/11/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Admin false positive submissions whose original verdict was Phish, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Phish.\r\nlet total = toscalar(CloudAppEvents\r\n | where ActionType == \"AdminSubmissionSubmitted\"\r\n | extend R = parse_json(RawEventData)\r\n | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Phish\"\r\n | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Phish\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Phish FPs'] = Pct", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/53/content/items/11/content/query", - "sourceSha256": "942f49b9d76b441e429e52472521cf70bea50866823f8deeed6b466b36bfc6cd", - "targetSha256": "942f49b9d76b441e429e52472521cf70bea50866823f8deeed6b466b36bfc6cd" - }, - { - "sourcePath": "/items/53/content/items/13/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "e3d2d9612489838c00ae7aa00cdb34680ec8f9305ff4207e31683850c63bb299" - }, - "conversion": { - "sourceId": "/items/53/content/items/13/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Admin false positive submissions whose original verdict was Spam, grouped by the detection method that flagged them. A high count means that method most often misclassifies legitimate mail as Spam.\r\nlet total = toscalar(CloudAppEvents\r\n | where ActionType == \"AdminSubmissionSubmitted\"\r\n | extend R = parse_json(RawEventData)\r\n | where tostring(R.SubmissionContentType) == \"Mail\" and tostring(R.SubmissionType) == \"3\" and tostring(R.DeliveryMessageInfo.FinalFilterVerdict) == \"Spam\"\r\n | count);\r\nCloudAppEvents\r\n| where ActionType == \"AdminSubmissionSubmitted\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), DetectionMethod = tostring(R.DeliveryMessageInfo.FinalFilterVerdictControlSource), DetectionVerdict = tostring(R.DeliveryMessageInfo.FinalFilterVerdict), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\" and DetectionVerdict == \"Spam\"\r\n| extend DetectionMethod = iif(isempty(DetectionMethod), \"Not specified\", DetectionMethod)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(P2SenderDomain) by DetectionMethod\r\n| extend Pct = iif(total == 0, 0.0, round(FPSubmissions * 100.0 / total, 1))\r\n| sort by FPSubmissions desc\r\n| project ['Detection Method'] = DetectionMethod, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains, ['% of Spam FPs'] = Pct", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/53/content/items/13/content/query", - "sourceSha256": "e3d2d9612489838c00ae7aa00cdb34680ec8f9305ff4207e31683850c63bb299", - "targetSha256": "e3d2d9612489838c00ae7aa00cdb34680ec8f9305ff4207e31683850c63bb299" - }, - { - "sourcePath": "/items/53/content/items/16/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "cca5d9e2b3d5e82f36d0925d5f0729efbb674450d043ae44c758063734b8c1a9" - }, - "conversion": { - "sourceId": "/items/53/content/items/16/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the top 10 sender domains of emails which are submitted as false positive by admins\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType ==\"3\"\r\n| summarize count() by P2SenderDomain\r\n| top 10 by count_ desc\r\n| project ['Sender Domain']=P2SenderDomain, ['Emails']=count_", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/53/content/items/16/content/query", - "sourceSha256": "cca5d9e2b3d5e82f36d0925d5f0729efbb674450d043ae44c758063734b8c1a9", - "targetSha256": "cca5d9e2b3d5e82f36d0925d5f0729efbb674450d043ae44c758063734b8c1a9" - }, - { - "sourcePath": "/items/53/content/items/17/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "5bcc51c8dd3bc4ca8453963c5fda413933c9c7797654ac4e6870c319eb5cb597" - }, - "conversion": { - "sourceId": "/items/53/content/items/17/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises all emails submitted as false positive by admins summarizing by the original filter verdict threat type\r\nCloudAppEvents \r\n| where ActionType == \"AdminSubmissionSubmitted\" \r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| extend Admin_SubmissionType=\r\niff(SubmissionType == \"3\" and ActionType == \"AdminSubmissionSubmitted\" and SubmissionContentType==\"Mail\" ,\"Email\",\r\n\"Other\"),\r\nP2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain),NetworkMessageId=tostring((parse_json(RawEventData).ObjectId)),DetectionVerdict=tostring((parse_json(RawEventData)).DeliveryMessageInfo.FinalFilterVerdict),PolicyOverride=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicyOverride),PolicyPolicyOverrideType=tostring((parse_json(RawEventData)).DeliveryMessageInfo.PolicySource)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| summarize count() by PolicyOverride,DetectionVerdict,Admin_SubmissionType\r\n| top 10 by count_ desc\r\n| project ['Policy Override']=PolicyOverride, ['Detection Verdict']=DetectionVerdict, ['Submission Type']=Admin_SubmissionType, ['Emails']=count_", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/53/content/items/17/content/query", - "sourceSha256": "5bcc51c8dd3bc4ca8453963c5fda413933c9c7797654ac4e6870c319eb5cb597", - "targetSha256": "5bcc51c8dd3bc4ca8453963c5fda413933c9c7797654ac4e6870c319eb5cb597" - }, - { - "sourcePath": "/items/54/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "67eab6668c5bbeaedd89ff5dd96d450db4dbb474face6b42c169077a2131f8bc" - }, - "conversion": { - "sourceId": "/items/54/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the daily ammount of user false positive submission by submission type.\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(CloudAppEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(CloudAppEvents | summarize max(Timestamp));\r\nlet agg = materialize(CloudAppEvents\r\n| where ActionType contains \"UserSubmission\"\r\n| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where SubmissionType == \"3\" and ActionType == \"UserSubmission\" and SubmissionContentType==\"Mail\"\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['User FP Submissions'] = coalesce(Count, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/54/content/items/2/content/query", - "sourceSha256": "67eab6668c5bbeaedd89ff5dd96d450db4dbb474face6b42c169077a2131f8bc", - "targetSha256": "67eab6668c5bbeaedd89ff5dd96d450db4dbb474face6b42c169077a2131f8bc" - }, - { - "sourcePath": "/items/54/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "8fa077a5e7acb929d4f838162f74ec00683d1dc97909896cd41a43f6095193e1" - }, - "conversion": { - "sourceId": "/items/54/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of user false positive submission by submission state.\r\nCloudAppEvents \r\n| where ActionType contains \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| summarize count() by tostring(SubmissionState)", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/54/content/items/5/content/query", - "sourceSha256": "8fa077a5e7acb929d4f838162f74ec00683d1dc97909896cd41a43f6095193e1", - "targetSha256": "8fa077a5e7acb929d4f838162f74ec00683d1dc97909896cd41a43f6095193e1" - }, - { - "sourcePath": "/items/54/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "06dfd0f0530c4081e868b6e444c344f00b01c0da62fbeaf59b1819d0ebfbdd56" - }, - "conversion": { - "sourceId": "/items/54/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the top users performing false positive submissions.\r\nCloudAppEvents \r\n| where ActionType == \"UserSubmission\" \r\n| extend Record = (parse_json(RawEventData)).RecordType,SubmissionState = parse_json(RawEventData).SubmissionState,SubmissionId=parse_json(RawEventData).SubmissionId,SubmissionType = parse_json(RawEventData).SubmissionType,SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)\r\n| where Record == 29 and SubmissionType == \"3\"\r\n| extend UserId = (parse_json(RawEventData)).UserId\r\n| summarize ['Submissions']=count() by ['User']=tostring(UserId)\r\n| top 15 by ['Submissions'] desc", - "resolvedTables": [ - "CloudAppEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/54/content/items/6/content/query", - "sourceSha256": "06dfd0f0530c4081e868b6e444c344f00b01c0da62fbeaf59b1819d0ebfbdd56", - "targetSha256": "06dfd0f0530c4081e868b6e444c344f00b01c0da62fbeaf59b1819d0ebfbdd56" - }, - { - "sourcePath": "/items/54/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "74d2514387026a9cbca80d7c6632732f497e6a9326931485517d26a115bc1098" - }, - "conversion": { - "sourceId": "/items/54/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//User false positive submissions whose email was originally flagged as Malware, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Malware.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Malware\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/54/content/items/8/content/query", - "sourceSha256": "74d2514387026a9cbca80d7c6632732f497e6a9326931485517d26a115bc1098", - "targetSha256": "74d2514387026a9cbca80d7c6632732f497e6a9326931485517d26a115bc1098" - }, - { - "sourcePath": "/items/54/content/items/10/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "0a98d004faf373375334191fda0147f3af0812c7ae871251a5728f1ffa5e72cd" - }, - "conversion": { - "sourceId": "/items/54/content/items/10/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//User false positive submissions whose email was originally flagged as Phish, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Phish.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Phish\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/54/content/items/10/content/query", - "sourceSha256": "0a98d004faf373375334191fda0147f3af0812c7ae871251a5728f1ffa5e72cd", - "targetSha256": "0a98d004faf373375334191fda0147f3af0812c7ae871251a5728f1ffa5e72cd" - }, - { - "sourcePath": "/items/54/content/items/12/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "3ef8df7f0af5e964483dd0d200d7015e761031dc4284f6c843af47858e0b56f0" - }, - "conversion": { - "sourceId": "/items/54/content/items/12/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//User false positive submissions whose email was originally flagged as Spam, by the detection technique that flagged it. A high count means that technique most often misclassifies legitimate mail as Spam.\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has \"Spam\"\r\n| mv-expand Technique = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Technique)\r\n| summarize FPSubmissions = count(), DistinctDomains = dcount(SenderFromDomain) by Technique\r\n| sort by FPSubmissions desc\r\n| project ['Detection Technique'] = Technique, ['FP Submissions'] = FPSubmissions, ['Distinct Sender Domains'] = DistinctDomains", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/54/content/items/12/content/query", - "sourceSha256": "3ef8df7f0af5e964483dd0d200d7015e761031dc4284f6c843af47858e0b56f0", - "targetSha256": "3ef8df7f0af5e964483dd0d200d7015e761031dc4284f6c843af47858e0b56f0" - }, - { - "sourcePath": "/items/54/content/items/14/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "01d2c3a9084d16561d96d52b2a9f43158cd0b5805f1bd1503f19bd79fc1fd0b1" - }, - "conversion": { - "sourceId": "/items/54/content/items/14/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Top 10 sender domains reported as false positives by users, with each domain's total inbound volume and the share of it reported as FP (a high rate flags a domain whose legitimate mail is most often misclassified).\r\nlet totalByDomain = EmailEvents | where EmailDirection == \"Inbound\" | summarize TotalInbound = count() by SenderFromDomain;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), P2SenderDomain = tostring(R.P2SenderDomain)\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| summarize FPSubmissions = count() by P2SenderDomain\r\n| join kind=leftouter (totalByDomain) on $left.P2SenderDomain == $right.SenderFromDomain\r\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Domain'] = P2SenderDomain, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/54/content/items/14/content/query", - "sourceSha256": "01d2c3a9084d16561d96d52b2a9f43158cd0b5805f1bd1503f19bd79fc1fd0b1", - "targetSha256": "01d2c3a9084d16561d96d52b2a9f43158cd0b5805f1bd1503f19bd79fc1fd0b1" - }, - { - "sourcePath": "/items/54/content/items/16/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "dee4810b520a32ee3eda3665ec91442f6b1b94e403bf850472313c0b0b92cc89" - }, - "conversion": { - "sourceId": "/items/54/content/items/16/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Top 10 email senders reported as false positives by users, with each sender's total inbound volume and the share reported as FP.\r\nlet totalBySender = EmailEvents | where EmailDirection == \"Inbound\" | summarize TotalInbound = count() by SenderMailFromAddress;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize FPSubmissions = count() by SenderMailFromAddress\r\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\r\n| extend FPPct = iif(isnull(TotalInbound) or TotalInbound == 0, 0.0, round(FPSubmissions * 100.0 / TotalInbound, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Inbound'] = coalesce(TotalInbound, 0), ['FP Submission %'] = FPPct", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/54/content/items/16/content/query", - "sourceSha256": "dee4810b520a32ee3eda3665ec91442f6b1b94e403bf850472313c0b0b92cc89", - "targetSha256": "dee4810b520a32ee3eda3665ec91442f6b1b94e403bf850472313c0b0b92cc89" - }, - { - "sourcePath": "/items/54/content/items/18/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "e855970dd652ea06edb6c39d05056de221c92079455389ff1c874c674260434e" - }, - "conversion": { - "sourceId": "/items/54/content/items/18/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Top 10 email subjects reported as false positives by users, with how many distinct recipients reported each (a subject reported by many users is a broad misclassification pattern).\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Inbound\"\r\n| summarize FPSubmissions = count(), DistinctRecipients = dcount(RecipientObjectId) by Subject\r\n| top 10 by FPSubmissions desc\r\n| project ['Subject'] = Subject, ['FP Submissions'] = FPSubmissions, ['Distinct Recipients'] = DistinctRecipients", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/54/content/items/18/content/query", - "sourceSha256": "e855970dd652ea06edb6c39d05056de221c92079455389ff1c874c674260434e", - "targetSha256": "e855970dd652ea06edb6c39d05056de221c92079455389ff1c874c674260434e" - }, - { - "sourcePath": "/items/54/content/items/20/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "574a57a292b61a545e06d553089b20c675d2deeebd757cc4041f71ee296658f2" - }, - "conversion": { - "sourceId": "/items/54/content/items/20/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Top 10 internal senders whose emails were reported as false positives by users, with total intra-org volume and the share reported as FP.\r\nlet totalBySender = EmailEvents | where EmailDirection == \"Intra-org\" | summarize TotalIntraOrg = count() by SenderMailFromAddress;\r\nCloudAppEvents\r\n| where ActionType == \"UserSubmission\"\r\n| extend R = parse_json(RawEventData)\r\n| extend SubmissionType = tostring(R.SubmissionType), SubmissionContentType = tostring(R.SubmissionContentType), NetworkMessageId = tostring(R.ObjectId), RecipientObjectId = AccountObjectId\r\n| where SubmissionContentType == \"Mail\" and SubmissionType == \"3\"\r\n| join EmailEvents on NetworkMessageId, RecipientObjectId\r\n| where EmailDirection == \"Intra-org\"\r\n| summarize FPSubmissions = count() by SenderMailFromAddress\r\n| join kind=leftouter (totalBySender) on SenderMailFromAddress\r\n| extend FPPct = iif(isnull(TotalIntraOrg) or TotalIntraOrg == 0, 0.0, round(FPSubmissions * 100.0 / TotalIntraOrg, 2))\r\n| top 10 by FPSubmissions desc\r\n| project ['Sender Address'] = SenderMailFromAddress, ['FP Submissions'] = FPSubmissions, ['Total Intra-org'] = coalesce(TotalIntraOrg, 0), ['FP Submission %'] = FPPct", - "resolvedTables": [ - "CloudAppEvents", - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "CloudAppEvents", - "ahTable": "CloudAppEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 37, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/54/content/items/20/content/query", - "sourceSha256": "574a57a292b61a545e06d553089b20c675d2deeebd757cc4041f71ee296658f2", - "targetSha256": "574a57a292b61a545e06d553089b20c675d2deeebd757cc4041f71ee296658f2" - }, - { - "sourcePath": "/items/56/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "ee6b26c853c749ddefdc422e3bf84d8957cfc20ec68caf97ea50c45a86fe6b8b" - }, - "conversion": { - "sourceId": "/items/56/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Microsoft Defender for Office 365 value for files in SharePoint / OneDrive / Teams: total files processed, how many had a malware detection, and how many were scanned with no detection. A per-period Trend series feeds the tile sparkline.\r\nlet gran = {Granularity};\r\nlet base = FileMaliciousContentInfo;\r\nlet counts = union\r\n(base | summarize Count = count() | extend Cat = \"Total Files Processed (SPO/ODB/Teams)\", Ord = 1),\r\n(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Cat = \"Files with Malware Detected\", Ord = 2),\r\n(base | where isempty(ThreatTypes) | summarize Count = count() | extend Cat = \"Files Scanned - No Detection\", Ord = 3);\r\nlet tagged = union\r\n(base | extend Cat = \"Total Files Processed (SPO/ODB/Teams)\"),\r\n(base | where isnotempty(ThreatTypes) | extend Cat = \"Files with Malware Detected\"),\r\n(base | where isempty(ThreatTypes) | extend Cat = \"Files Scanned - No Detection\");\r\nlet trends = tagged | make-series Trend = count() default = 0 on Timestamp step gran by Cat;\r\ncounts\r\n| join kind=leftouter (trends) on Cat\r\n| sort by Ord asc\r\n| project Count, Details = Cat, Trend", - "resolvedTables": [ - "FileMaliciousContentInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "FileMaliciousContentInfo", - "ahTable": "FileMaliciousContentInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 17, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/56/content/query", - "sourceSha256": "ee6b26c853c749ddefdc422e3bf84d8957cfc20ec68caf97ea50c45a86fe6b8b", - "targetSha256": "ee6b26c853c749ddefdc422e3bf84d8957cfc20ec68caf97ea50c45a86fe6b8b" - }, - { - "sourcePath": "/items/57/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "3f30b8073c8b9cfd3304c7294b4171f12b9760e27160c598bcf9843a95234022" - }, - "conversion": { - "sourceId": "/items/57/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total files located on SharePoint, OneDrive and Teams with Malware detections over time summarizing the data daily.\r\nlet gran = {Granularity};\r\nlet agg = materialize(FileMaliciousContentInfo\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Files']=coalesce(Count, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "FileMaliciousContentInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "FileMaliciousContentInfo", - "ahTable": "FileMaliciousContentInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 17, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/57/content/items/2/content/query", - "sourceSha256": "3f30b8073c8b9cfd3304c7294b4171f12b9760e27160c598bcf9843a95234022", - "targetSha256": "3f30b8073c8b9cfd3304c7294b4171f12b9760e27160c598bcf9843a95234022" - }, - { - "sourcePath": "/items/57/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "87a79048564af89105306f9f0eb6e49d2877f0cb1fe9e4fdbe325666b51b4ff7" - }, - "conversion": { - "sourceId": "/items/57/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query summarizes File malware detections by Microsoft Defender for Office 365 (Safe Attachments detonation) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\r\nFileMaliciousContentInfo\r\n| where tostring(DetectionMethods) contains \"detonation\"\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\r\n| sort by ['Files'] desc\r\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']", - "resolvedTables": [ - "FileMaliciousContentInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "FileMaliciousContentInfo", - "ahTable": "FileMaliciousContentInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 17, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/57/content/items/4/content/query", - "sourceSha256": "87a79048564af89105306f9f0eb6e49d2877f0cb1fe9e4fdbe325666b51b4ff7", - "targetSha256": "87a79048564af89105306f9f0eb6e49d2877f0cb1fe9e4fdbe325666b51b4ff7" - }, - { - "sourcePath": "/items/57/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "9ea07eb7836f2e2b1040b6b6e44a86a4c61d61e49c16dc1428c6fc2bb7b6d9d6" - }, - "conversion": { - "sourceId": "/items/57/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query summarizes File malware detections by the built-in SharePoint antivirus (Antimalware engine) into a per-family table: total detections, distinct files, affected locations (file owner or site) and when the family was last seen.\r\nFileMaliciousContentInfo\r\n| where tostring(DetectionMethods) contains \"Antimalware engine\"\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Files']=count(), ['Distinct Files']=dcount(SHA256), ['Affected Locations']=dcount(Owner), ['Last Seen']=max(Timestamp) by ThreatNames\r\n| sort by ['Files'] desc\r\n| project ['Threat Name']=ThreatNames, ['Files'], ['Distinct Files'], ['Affected Locations'], ['Last Seen']", - "resolvedTables": [ - "FileMaliciousContentInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "FileMaliciousContentInfo", - "ahTable": "FileMaliciousContentInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 17, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/57/content/items/6/content/query", - "sourceSha256": "9ea07eb7836f2e2b1040b6b6e44a86a4c61d61e49c16dc1428c6fc2bb7b6d9d6", - "targetSha256": "9ea07eb7836f2e2b1040b6b6e44a86a4c61d61e49c16dc1428c6fc2bb7b6d9d6" - }, - { - "sourcePath": "/items/57/content/items/9/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "83eaddab2b108a2803044a325510009d0047dd94858008d869c8659b7ceb14cf" - }, - "conversion": { - "sourceId": "/items/57/content/items/9/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query lists total Malware detections of files on SharePoint, OneDrive and Teams by the location (site or personal path) where the file resides.\r\nFileMaliciousContentInfo\r\n| extend ['Site / Location'] = tostring(split(FolderPath, '/')[4])\r\n| summarize ['Detections'] = count() by ['Site / Location']\r\n| sort by ['Detections'] desc", - "resolvedTables": [ - "FileMaliciousContentInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "FileMaliciousContentInfo", - "ahTable": "FileMaliciousContentInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 17, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/57/content/items/9/content/query", - "sourceSha256": "83eaddab2b108a2803044a325510009d0047dd94858008d869c8659b7ceb14cf", - "targetSha256": "83eaddab2b108a2803044a325510009d0047dd94858008d869c8659b7ceb14cf" - }, - { - "sourcePath": "/items/57/content/items/10/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "ddfe37ebdf81dc3035d9491a0fc453cd230d183059224a86193e44f1e852f98f" - }, - "conversion": { - "sourceId": "/items/57/content/items/10/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams summarizing the data by the Microsoft collaboration application (workload).\r\nFileMaliciousContentInfo\r\n| summarize count() by Workload\r\n| sort by count_ desc", - "resolvedTables": [ - "FileMaliciousContentInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "FileMaliciousContentInfo", - "ahTable": "FileMaliciousContentInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 17, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/57/content/items/10/content/query", - "sourceSha256": "ddfe37ebdf81dc3035d9491a0fc453cd230d183059224a86193e44f1e852f98f", - "targetSha256": "ddfe37ebdf81dc3035d9491a0fc453cd230d183059224a86193e44f1e852f98f" - }, - { - "sourcePath": "/items/57/content/items/12/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "change", - "querySha256": "c0af2e879bb305a1ab536cf7aa9a94c0da845893774b6af9441c54e7e26c20d8" - }, - "conversion": { - "sourceId": "/items/57/content/items/12/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Top file owners (or the SharePoint/Teams site, when a file has no user owner) whose SharePoint/OneDrive/Teams files were flagged as malware, with distinct files, workloads and sample threat names.\r\nFileMaliciousContentInfo\r\n| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat(\"Site: \", tostring(split(FolderPath, \"/\")[4])))\r\n| summarize ['Malicious Files'] = count(),\n ['Distinct Files'] = dcount(SHA256),\n ['Workloads'] = make_set(Workload, 3),\n ['Sample Threats'] = make_set_if(ThreatNames, isnotempty(ThreatNames), 5),\n ['Last Seen'] = max(Timestamp)\n by ['Owner']=Owner\n| top 20 by ['Malicious Files']", - "resolvedTables": [ - "FileMaliciousContentInfo" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "FileMaliciousContentInfo", - "ahTable": "FileMaliciousContentInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 17, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/57/content/items/12/content/query", - "sourceSha256": "c0af2e879bb305a1ab536cf7aa9a94c0da845893774b6af9441c54e7e26c20d8", - "targetSha256": "c0af2e879bb305a1ab536cf7aa9a94c0da845893774b6af9441c54e7e26c20d8" - }, - { - "sourcePath": "/items/59/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "edac2c04a18e08b3c8a7fdfe6e239e2d594008e09c07b78183ace649b0afcd49" - }, - "conversion": { - "sourceId": "/items/59/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge.\r\nlet gran = {Granularity};\r\nlet agg = materialize(EmailPostDeliveryEvents \r\n| where ActionType has \"ZAP\"\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Zapped Emails'] = coalesce(Count, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/59/content/items/3/content/query", - "sourceSha256": "edac2c04a18e08b3c8a7fdfe6e239e2d594008e09c07b78183ace649b0afcd49", - "targetSha256": "edac2c04a18e08b3c8a7fdfe6e239e2d594008e09c07b78183ace649b0afcd49" - }, - { - "sourcePath": "/items/59/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "81205f70e013612c81806cbd61ce60b78f4bbfaf406cc4b71f15d729ffe318ed" - }, - "conversion": { - "sourceId": "/items/59/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the daily ammount of emails that had a post delivery action from zero-hour auto purge, summarizing by phish,spam or malware detection action\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionType has \"ZAP\"\r\n| summarize [\"Spam ZAP\"]=countif(ActionType has 'Spam ZAP'), [\"Phish ZAP\"]=countif(ActionType has 'Phish ZAP'), [\"Malware ZAP\"]=countif(ActionType has 'Malware ZAP') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Spam ZAP\"]=coalesce([\"Spam ZAP\"],0), [\"Phish ZAP\"]=coalesce([\"Phish ZAP\"],0), [\"Malware ZAP\"]=coalesce([\"Malware ZAP\"],0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/59/content/items/4/content/query", - "sourceSha256": "81205f70e013612c81806cbd61ce60b78f4bbfaf406cc4b71f15d729ffe318ed", - "targetSha256": "81205f70e013612c81806cbd61ce60b78f4bbfaf406cc4b71f15d729ffe318ed" - }, - { - "sourcePath": "/items/59/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "b092296adbbd8f13d3ba1dd7ce16b3d4430acf7e0c5b9245dcb65e8305634561" - }, - "conversion": { - "sourceId": "/items/59/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the ammount of emails that had a post delivery action, summarizing the data daily by the final location as a result of the action\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionType contains \"ZAP\"\r\n| summarize Quarantine=countif(DeliveryLocation has 'Quarantine'), ['Deleted Items']=countif(DeliveryLocation has 'Delete'), Junk=countif(DeliveryLocation has 'Junk'), Inbox=countif(DeliveryLocation has 'Inbox') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, Quarantine=coalesce(Quarantine,0), ['Deleted Items']=coalesce(['Deleted Items'],0), Junk=coalesce(Junk,0), Inbox=coalesce(Inbox,0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/59/content/items/6/content/query", - "sourceSha256": "b092296adbbd8f13d3ba1dd7ce16b3d4430acf7e0c5b9245dcb65e8305634561", - "targetSha256": "b092296adbbd8f13d3ba1dd7ce16b3d4430acf7e0c5b9245dcb65e8305634561" - }, - { - "sourcePath": "/items/60/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "f80a170b71ca7aea90a853d397c7cc66efc0727f7e8b1136c999be841598810a" - }, - "conversion": { - "sourceId": "/items/60/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the daily ammount of emails released from quarantine\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionTrigger has \"AdminAction\" and Action has 'Quarantine release'\r\n| summarize Count = count() by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, ['Quarantine Releases'] = coalesce(Count, 0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/60/content/items/2/content/query", - "sourceSha256": "f80a170b71ca7aea90a853d397c7cc66efc0727f7e8b1136c999be841598810a", - "targetSha256": "f80a170b71ca7aea90a853d397c7cc66efc0727f7e8b1136c999be841598810a" - }, - { - "sourcePath": "/items/60/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965" - }, - "conversion": { - "sourceId": "/items/60/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the percentage of emails released from quarantine out of the total ammount of quarantined emails\r\nlet Quarantine_Releases = toscalar(EmailPostDeliveryEvents\r\n| where Action == \"Quarantine release\"\r\n| join kind=leftouter (EmailEvents | where DeliveryLocation == \"Quarantine\") on NetworkMessageId\r\n| summarize count());\r\nlet Quarantined_Mailflow = toscalar(EmailEvents | where DeliveryLocation == \"Quarantine\"\r\n| summarize count());\r\nprint\r\nQuarantine_Releases = toreal(Quarantine_Releases),\r\nQuarantined_Mailflow = toreal(Quarantined_Mailflow),\r\nRelease_Percentage = abs(round(((toreal(Quarantine_Releases)/toreal(Quarantined_Mailflow))*100),2))", - "resolvedTables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/60/content/items/5/content/query", - "sourceSha256": "b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965", - "targetSha256": "b9a2ddf63c5404a5073a9d0a9707bd5adfe06254d526136d9c94310279a51965" - }, - { - "sourcePath": "/items/60/content/items/6/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "3bc615d6bc4814e663b33dee2194e9c20b3664fea51cf465413b5931bebbb30e" - }, - "conversion": { - "sourceId": "/items/60/content/items/6/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Per detection technology: the share of its quarantined emails that were later released from quarantine.\r\n//Release % = released / quarantined for that detection technology - a high rate flags a detector that may be over-flagging legitimate mail (potential false positives). Detectors with fewer than 10 quarantined emails are excluded so the rate is statistically meaningful.\r\nEmailEvents\r\n| where DeliveryLocation == \"Quarantine\"\r\n| extend MDO_detection = parse_json(DetectionMethods)\r\n| extend FirstDetection = iif(isempty(MDO_detection), \"Clean\", tostring(bag_keys(MDO_detection)[0]))\r\n| extend FirstSubcategory = iif(FirstDetection != \"Clean\" and array_length(MDO_detection[FirstDetection]) > 0, strcat(FirstDetection, \": \", tostring(MDO_detection[FirstDetection][0])), \"No Detection (clean)\")\r\n| where FirstSubcategory contains \"Malware\" or FirstSubcategory contains \"Phish\" or FirstSubcategory contains \"Spam\"\r\n| join kind=leftouter (\r\n EmailPostDeliveryEvents\r\n | where Action == \"Quarantine release\"\r\n | distinct NetworkMessageId\r\n | extend ReleasedFlag = \"yes\"\r\n ) on NetworkMessageId\r\n| summarize Quarantined = dcount(NetworkMessageId), Released = dcountif(NetworkMessageId, ReleasedFlag == \"yes\") by FirstSubcategory\r\n| where Quarantined >= 10 and Released > 0\r\n| extend ReleaseRate = round(Released * 100.0 / Quarantined, 2)\r\n| project ['Detection Type']=FirstSubcategory, ['Quarantined Emails']=Quarantined, ['Released']=Released, ['Release %']=ReleaseRate\r\n| order by ['Release %'] desc", - "resolvedTables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/60/content/items/6/content/query", - "sourceSha256": "3bc615d6bc4814e663b33dee2194e9c20b3664fea51cf465413b5931bebbb30e", - "targetSha256": "3bc615d6bc4814e663b33dee2194e9c20b3664fea51cf465413b5931bebbb30e" - }, - { - "sourcePath": "/items/60/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "613f59e248e2eab9ad627bc17fd671a48892e3ba03cd55291062e0247cffde9b" - }, - "conversion": { - "sourceId": "/items/60/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the ammount of malware emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has \"Malware\" and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Details = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/60/content/items/8/content/query", - "sourceSha256": "613f59e248e2eab9ad627bc17fd671a48892e3ba03cd55291062e0247cffde9b", - "targetSha256": "613f59e248e2eab9ad627bc17fd671a48892e3ba03cd55291062e0247cffde9b" - }, - { - "sourcePath": "/items/60/content/items/9/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "f038b8c64ee2b6006197ae4f79bfbcaa804bded2a217d5a1cb1cbdb9fe7c3ea2" - }, - "conversion": { - "sourceId": "/items/60/content/items/9/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of malware emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Malware (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Malware' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Malware = parse_json(DetectionMethods).Malware to typeof(string)\r\n| where isnotempty(Malware)\r\n| summarize count() by Malware\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Malware, ['Detections']=count_", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/60/content/items/9/content/query", - "sourceSha256": "f038b8c64ee2b6006197ae4f79bfbcaa804bded2a217d5a1cb1cbdb9fe7c3ea2", - "targetSha256": "f038b8c64ee2b6006197ae4f79bfbcaa804bded2a217d5a1cb1cbdb9fe7c3ea2" - }, - { - "sourcePath": "/items/60/content/items/11/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "25b86347cd154b8e771535c9325c88198b601d431805ca0e7ed7ff6ab2c07f74" - }, - "conversion": { - "sourceId": "/items/60/content/items/11/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the ammount of phish emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailEvents\r\n| where DetectionMethods has \"Phish\" and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Details = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/60/content/items/11/content/query", - "sourceSha256": "25b86347cd154b8e771535c9325c88198b601d431805ca0e7ed7ff6ab2c07f74", - "targetSha256": "25b86347cd154b8e771535c9325c88198b601d431805ca0e7ed7ff6ab2c07f74" - }, - { - "sourcePath": "/items/60/content/items/12/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "d60acc2675082cf943ddec5d9e20e15c2062248cd551c8496e15c7eace2fbe40" - }, - "conversion": { - "sourceId": "/items/60/content/items/12/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of phish emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Phish (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Phish' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Phish = parse_json(DetectionMethods).Phish to typeof(string)\r\n| where isnotempty(Phish)\r\n| summarize count() by Phish\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Phish, ['Detections']=count_", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/60/content/items/12/content/query", - "sourceSha256": "d60acc2675082cf943ddec5d9e20e15c2062248cd551c8496e15c7eace2fbe40", - "targetSha256": "d60acc2675082cf943ddec5d9e20e15c2062248cd551c8496e15c7eace2fbe40" - }, - { - "sourcePath": "/items/60/content/items/14/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "b16218774694e423515732434466775a515223c7db107d015853617ad6951203" - }, - "conversion": { - "sourceId": "/items/60/content/items/14/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the ammount of spam emails that are quarantined, summarized daily by the detection method\r\nlet gran = {Granularity};\r\nlet baseQuery = EmailEvents\r\n| where DetectionMethods has \"Spam\" and DeliveryLocation == \"Quarantine\";\r\nlet agg = materialize(baseQuery\r\n| mv-expand Details = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Details)\r\n| summarize Count = count() by Details, Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from toscalar(agg | summarize min(Timestamp)) to toscalar(agg | summarize max(Timestamp)) step gran\r\n| extend d = 1 | join kind=inner (agg | distinct Details | extend d = 1) on d | project Timestamp, Details\r\n| join kind=leftouter (agg) on Timestamp, Details\r\n| project Timestamp, Details, Count = coalesce(Count, 0)\r\n| sort by Details asc, Timestamp asc", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/60/content/items/14/content/query", - "sourceSha256": "b16218774694e423515732434466775a515223c7db107d015853617ad6951203", - "targetSha256": "b16218774694e423515732434466775a515223c7db107d015853617ad6951203" - }, - { - "sourcePath": "/items/60/content/items/15/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "c48959232f63cbd06ace85302b75f0cb07dda479598e7c91e8d8b2cb01080ddc" - }, - "conversion": { - "sourceId": "/items/60/content/items/15/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the total ammount of spam emails that are quarantined, summarized by the detection method\r\n//(QA 2026-07-14) mv-expand over DetectionMethods.Spam (matching the sibling line chart) so each slice is a clean single method name instead of a bracketed JSON array.\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and DetectionMethods has 'Spam' and DeliveryLocation == \"Quarantine\"\r\n| mv-expand Spam = parse_json(DetectionMethods).Spam to typeof(string)\r\n| where isnotempty(Spam)\r\n| summarize count() by Spam\r\n| sort by count_ desc\r\n| project ['Detection Technology']=Spam, ['Detections']=count_", - "resolvedTables": [ - "EmailEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/60/content/items/15/content/query", - "sourceSha256": "c48959232f63cbd06ace85302b75f0cb07dda479598e7c91e8d8b2cb01080ddc", - "targetSha256": "c48959232f63cbd06ace85302b75f0cb07dda479598e7c91e8d8b2cb01080ddc" - }, - { - "sourcePath": "/items/62/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "b672a1c614ecc913ceba44e3d5b057d66e99529dfbf5d584fc6eaa6b4ebceb11" - }, - "conversion": { - "sourceId": "/items/62/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// Filter for incidents that have at least one Email Security alert\r\nlet gran = {Granularity};\r\nlet OfficeEmailAlerts = SecurityAlert\r\n | where ProductName contains \"Office 365 Advanced Threat Protection\" or ProductName contains \"Microsoft 365 Defender\"\r\n | project SystemAlertId;\r\nlet agg = materialize(SecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| where isnotempty(AlertIds) and not(Title startswith \"CC_\")\r\n| extend AlertId = tostring(AlertIds) \r\n| join kind=inner\r\n (OfficeEmailAlerts | extend SystemAlertId = tostring(SystemAlertId))\r\n on $left.AlertId == $right.SystemAlertId\r\n| summarize arg_max(TimeGenerated, *), AlertCount = dcount(AlertId) by IncidentNumber\r\n| summarize Incidents_Number = count() by TimeGenerated = bin(TimeGenerated, gran));\r\nrange TimeGenerated from toscalar(agg | summarize min(TimeGenerated)) to toscalar(agg | summarize max(TimeGenerated)) step gran\r\n| join kind=leftouter (agg) on TimeGenerated\r\n| project TimeGenerated, ['Email Security Incidents'] = coalesce(Incidents_Number, 0)\r\n| sort by TimeGenerated asc", - "resolvedTables": [ - "SecurityAlert" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "SecurityAlert", - "ahTable": "SecurityAlert", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 32, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/62/content/items/2/content/query", - "sourceSha256": "b672a1c614ecc913ceba44e3d5b057d66e99529dfbf5d584fc6eaa6b4ebceb11", - "targetSha256": "b672a1c614ecc913ceba44e3d5b057d66e99529dfbf5d584fc6eaa6b4ebceb11" - }, - { - "sourcePath": "/items/62/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "0510124e9e2e0050312b7e85075f4ede40a20cde14a6c7e228ff3c5ed7a8a7fa" - }, - "conversion": { - "sourceId": "/items/62/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// Categorize incidents: Email Security vs Other\r\nlet AllAlerts = SecurityAlert\r\n | extend SystemAlertId = tostring(SystemAlertId)\r\n | project SystemAlertId, ProductName;\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| mv-expand AlertIds\r\n| where isnotempty(AlertIds) and not(Title startswith \"CC_\")\r\n| extend AlertId = tostring(AlertIds)\r\n| join kind=inner\r\n (AllAlerts)\r\n on $left.AlertId == $right.SystemAlertId\r\n| summarize AlertSystems = make_set(ProductName) by IncidentNumber\r\n| extend HasEmailSecurity = \r\n AlertSystems has \"Office 365 Advanced Threat Protection\" or \r\n AlertSystems has \"Microsoft 365 Defender\"\r\n| extend Category = iff(HasEmailSecurity, \"Email Security\", \"Other\")\r\n| summarize IncidentCount = count() by Category\r\n", - "resolvedTables": [ - "SecurityAlert" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "SecurityAlert", - "ahTable": "SecurityAlert", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 32, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/62/content/items/3/content/query", - "sourceSha256": "0510124e9e2e0050312b7e85075f4ede40a20cde14a6c7e228ff3c5ed7a8a7fa", - "targetSha256": "0510124e9e2e0050312b7e85075f4ede40a20cde14a6c7e228ff3c5ed7a8a7fa" - }, - { - "sourcePath": "/items/62/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "c7c7df7094a339e5e22d115c7ee5595eadd1b0dc2f137af7a5581c6dfde09212" - }, - "conversion": { - "sourceId": "/items/62/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// SLA thresholds by severity for email-security (MDO) incidents\r\nlet SLA_Variables = datatable (Severity:string, TimeToResolve:int) [\r\n \"High\", 60,\r\n \"Medium\", 120,\r\n \"Low\", 240,\r\n \"Informational\", 480\r\n];\r\n\r\n// Identify MDO-related incidents via alert correlation\r\nlet EmailSecurityIncidents = \r\n SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for each MDO-related incident\r\nlet LatestMdoIncidents =\r\n SecurityIncident\r\n | summarize arg_max(TimeGenerated, Classification, Status, Severity, CreatedTime, ClosedTime, Title) by ProviderIncidentId\r\n | where ProviderIncidentId in (EmailSecurityIncidents)\r\n | where not(Title startswith \"CC_\"); // Exclude non-email incidents as needed\r\n\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| extend TimeToResolveIncident = datetime_diff('minute', ClosedTime, CreatedTime)\r\n| join kind=inner SLA_Variables on Severity\r\n| summarize\r\n ['Avg Time to Close (min)'] = avg(TimeToResolveIncident),\r\n CountIncidents = count(), Breached = countif(TimeToResolveIncident > TimeToResolve)\r\n by Day = bin(ClosedTime, 1d), Severity\r\n| order by Day asc, Severity asc", - "resolvedTables": [ - "SecurityAlert" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "SecurityAlert", - "ahTable": "SecurityAlert", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 32, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/62/content/items/5/content/query", - "sourceSha256": "c7c7df7094a339e5e22d115c7ee5595eadd1b0dc2f137af7a5581c6dfde09212", - "targetSha256": "c7c7df7094a339e5e22d115c7ee5595eadd1b0dc2f137af7a5581c6dfde09212" - }, - { - "sourcePath": "/items/62/content/items/6/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "493db12dce8505fe5fc8a428b0234b0edab5aa969ffed85eba0979392066de07" - }, - "conversion": { - "sourceId": "/items/62/content/items/6/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// Build a list of MDO-related incidents by cross-referencing SecurityAlert\r\nlet EmailSecurityIncidents = SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get only the most recent state of each incident, ensuring it's MDO-related\r\nlet LatestIncidents = SecurityIncident\r\n | summarize arg_max(TimeGenerated, Classification, Status, Title) by ProviderIncidentId\r\n | where ProviderIncidentId in (EmailSecurityIncidents)\r\n | where not(Title startswith \"CC_\"); // Exclude incidents unrelated to MDO (e.g., DSPM)\r\n\r\nLatestIncidents\r\n| where Status == 'Closed' // (Optional) Limit to closed/fully classified incidents\r\n| summarize Count = count() by Classification = iif(\r\n isnull(Classification) or trim(\" \", Classification) == \"\",\r\n \"Not Set\", \r\n Classification\r\n )\r\n| order by Count desc", - "resolvedTables": [ - "SecurityAlert" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "SecurityAlert", - "ahTable": "SecurityAlert", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 32, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/62/content/items/6/content/items/3/content/query", - "sourceSha256": "493db12dce8505fe5fc8a428b0234b0edab5aa969ffed85eba0979392066de07", - "targetSha256": "493db12dce8505fe5fc8a428b0234b0edab5aa969ffed85eba0979392066de07" - }, - { - "sourcePath": "/items/62/content/items/6/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "5223b5ffad53a8e07a06758ad06c08ee75ba11e8f5a50644108e80cb8123de41" - }, - "conversion": { - "sourceId": "/items/62/content/items/6/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// Identify MDO-related SecurityIncident IDs via alert correlation\r\nlet EmailSecurityIncidents = \r\n SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get latest incident state for MDO-related incidents\r\nlet LatestMdoIncidents =\r\n SecurityIncident\r\n | summarize arg_max(TimeGenerated, Classification, Status, IncidentName) by ProviderIncidentId\r\n | where ProviderIncidentId in (EmailSecurityIncidents)\r\n // Exclude other non-email incidents (e.g., DSPM with specific naming pattern)\r\n | where not(IncidentName startswith \"CC_\");\r\n\r\n// Compute true positive rate among closed MDO incidents\r\nLatestMdoIncidents\r\n| where Status == \"Closed\"\r\n| summarize\r\n TruePositiveCount = countif(Classification == \"TruePositive\"),\r\n TotalClosed = count()\r\n| extend TruePositiveRate = iff(\r\n TotalClosed > 0,\r\n TruePositiveCount * 100.0 / TotalClosed,\r\n real(null)\r\n)", - "resolvedTables": [ - "SecurityAlert" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "SecurityAlert", - "ahTable": "SecurityAlert", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 32, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/62/content/items/6/content/items/4/content/query", - "sourceSha256": "5223b5ffad53a8e07a06758ad06c08ee75ba11e8f5a50644108e80cb8123de41", - "targetSha256": "5223b5ffad53a8e07a06758ad06c08ee75ba11e8f5a50644108e80cb8123de41" - }, - { - "sourcePath": "/items/62/content/items/6/content/items/5/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "cbf34290f39ff95c283975a7fd08261058cd70b52ac8e2fd3aa333fb11ed8820" - }, - "conversion": { - "sourceId": "/items/62/content/items/6/content/items/5/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This queries shows the last activity on the Incident and attempts to display auto resolved incidents vs manual interaction.\r\n//Add strings for your automations if you rely on any other application/system\r\n//Fewer human-closed incidents (and a higher automated closure rate) generally indicates greater SecOps efficiency, as automation is successfully handling more work.\r\n\r\n// Identify MDO-related incidents by joining SecurityIncident and SecurityAlert\r\nlet EmailSecurityIncidents = SecurityIncident\r\n | mv-expand AlertIds\r\n | where isnotempty(AlertIds)\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind=inner (\r\n SecurityAlert\r\n | where ProductName in (\"Office 365 Advanced Threat Protection\", \"Microsoft 365 Defender\")\r\n | extend AlertId = tostring(SystemAlertId)\r\n | project AlertId\r\n ) on AlertId\r\n | distinct ProviderIncidentId;\r\n\r\n// Get latest status of each incident and count closed incidents by who closed them\r\nSecurityIncident\r\n| summarize arg_max(TimeGenerated, *) by ProviderIncidentId\r\n| where ProviderIncidentId in (EmailSecurityIncidents)\r\n| where Status == 'Closed'\r\n| where not(Title startswith \"CC_\") // Exclude non-MDO incidents from DSPM policies\r\n| extend ClosedBy = iff( // Add strings for your automation systems\r\n tolower(ModifiedBy) has_any (\"system\",\"azure\",\"automation\",\"playbook\",\"microsoft xdr\",\"microsoft defender xdr\",\"created from alert\"),\r\n \"Automated\",\r\n \"Human\"\r\n )\r\n| summarize ClosedCount = count() by ClosedBy", - "resolvedTables": [ - "SecurityAlert" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "SecurityAlert", - "ahTable": "SecurityAlert", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 32, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/62/content/items/6/content/items/5/content/query", - "sourceSha256": "cbf34290f39ff95c283975a7fd08261058cd70b52ac8e2fd3aa333fb11ed8820", - "targetSha256": "cbf34290f39ff95c283975a7fd08261058cd70b52ac8e2fd3aa333fb11ed8820" - }, - { - "sourcePath": "/items/63/content/items/2/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "db26d96be276c8946212e0211434d4267fdf79ce1261ad7974477d966fb1c7f9" - }, - "conversion": { - "sourceId": "/items/63/content/items/2/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query attempts to show AIR Efficiency Over Time by displaying the number of successes and failures over time\r\nEmailPostDeliveryEvents\r\n| where ActionType =~ \"Automated Remediation\"\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Count = count() by bin(Timestamp, {Granularity}), ActionResult", - "resolvedTables": [ - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/63/content/items/2/content/query", - "sourceSha256": "db26d96be276c8946212e0211434d4267fdf79ce1261ad7974477d966fb1c7f9", - "targetSha256": "db26d96be276c8946212e0211434d4267fdf79ce1261ad7974477d966fb1c7f9" - }, - { - "sourcePath": "/items/63/content/items/4/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "ba98b4288543b6bc2c36341afad18fd44fddec3ef80da5315adaf5fb63391815" - }, - "conversion": { - "sourceId": "/items/63/content/items/4/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// SOC metric: Daily average/p75 delay (in minutes) from email delivery to AIR action\r\nlet deliveries = EmailEvents\r\n | where DeliveryAction == \"Delivered\"// delivered emails\r\n | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n | summarize FirstDelivery = min(Timestamp) by MsgKey, Threat = tostring(ThreatTypes);\r\nlet remediations = EmailPostDeliveryEvents\r\n | where ActionType =~ \"Automated Remediation\"// automated remediation events\r\n | extend MsgKey = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n | summarize FirstRemediation = min(Timestamp) by MsgKey;\r\ndeliveries\r\n| join kind=inner remediations on MsgKey\r\n| extend DelayMinutes = datetime_diff(\"minute\", FirstRemediation, FirstDelivery)\r\n| where DelayMinutes >= 0\r\n| summarize ['Avg (min)'] = avg(DelayMinutes),\r\n ['P80 (min)'] = percentile(DelayMinutes, 80),\r\n ['P90 (min)'] = percentile(DelayMinutes, 90),\r\n ['P99 (min)'] = percentile(DelayMinutes, 99),\r\n CountEmails = count()\r\n by bin(FirstRemediation, 1d) ", - "resolvedTables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/63/content/items/4/content/query", - "sourceSha256": "ba98b4288543b6bc2c36341afad18fd44fddec3ef80da5315adaf5fb63391815", - "targetSha256": "ba98b4288543b6bc2c36341afad18fd44fddec3ef80da5315adaf5fb63391815" - }, - { - "sourcePath": "/items/63/content/items/7/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "5014049df6a062e39d058ec8a8dd718242035db12af272e5181956a41da6fadd" - }, - "conversion": { - "sourceId": "/items/63/content/items/7/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "// AIR investigation outcomes by day: ThreatDetected vs. Clean\r\n\r\n// Step 1: Deduplicate automated remediation events by message and recipient\r\nlet AutoRemediations = \r\n EmailPostDeliveryEvents\r\n | where ActionType == \"Automated Remediation\"\r\n | summarize arg_max(Timestamp, ActionResult) by NetworkMessageId, RecipientEmailAddress\r\n | project NetworkMessageId, RecipientEmailAddress, Timestamp;\r\n\r\n// Step 2: Derive threat verdicts using AlertEvidence\r\nlet EvidenceVerdicts =\r\n AlertEvidence\r\n | where EntityType in (\"MailMessage\", \"MailCluster\")\r\n | extend extra = todynamic(AdditionalFields)\r\n // If this is a mail cluster, use provided NetworkMessageIds array; otherwise wrap NetworkMessageId as a single-item array\r\n | extend networkIds = iff(\r\n isnull(extra.NetworkMessageIds) or array_length(extra.NetworkMessageIds) == 0,\r\n pack_array(NetworkMessageId), // create a single-element array using pack_array\r\n extra.NetworkMessageIds // use the array as-is if it exists\r\n )\r\n | mv-expand nmID = networkIds // expand to individual message IDs\r\n // Derive verdict from LastVerdict, ThreatAnalysisSummary, and ThreatIntelligence\r\n | extend \r\n lastVerdict = tolower(tostring(extra.LastVerdict)),\r\n threatAIList = extra.ThreatAnalysisSummary,\r\n threatInt = extra.ThreatIntelligence\r\n | extend verdictFromAnalysis = iff(array_length(threatAIList) > 0, tolower(tostring(threatAIList[0].Verdict)), \"\"),\r\n verdictTI = iff(array_length(threatInt) > 0, \"malicious\", \"\") // any item in ThreatIntelligence indicates malicious\r\n // Mark as threat-detected if verdict is malicious/suspicious or threat evidence is present\r\n | extend ThreatDetectedFlag = \r\n case(\r\n lastVerdict in (\"malicious\",\"suspicious\") or verdictFromAnalysis in (\"malicious\",\"suspicious\")\r\n or verdictTI == \"malicious\",\r\n true,\r\n false\r\n )\r\n // Weight mail clusters by MailCount; default to 1 for single messages\r\n | extend MailCountInt = toint(extra.MailCount)\r\n | extend Weight = iff(EntityType == \"MailCluster\", \r\n coalesce(MailCountInt, 1), // default to 1 if MailCount is missing\r\n 1)\r\n | summarize IsThreatDetected = any(ThreatDetectedFlag), \r\n WeightSum = sum(Weight) \r\n by nmID = tostring(nmID);\r\n\r\n// Step 3: Join remediation events with verdicts and aggregate by day\r\nAutoRemediations\r\n| join kind=leftouter EvidenceVerdicts on $left.NetworkMessageId == $right.nmID\r\n| extend isThreat = coalesce(IsThreatDetected, false), \r\n effectiveWeight= coalesce(WeightSum, 1)\r\n| extend InvestigationOutcome = iif(isThreat, \"Threat Detected\", \"Clean\")\r\n| summarize PreventionCount = sum(effectiveWeight) by Day = bin(Timestamp, {Granularity}), InvestigationOutcome\r\n| order by Day asc, InvestigationOutcome asc", - "resolvedTables": [ - "AlertEvidence", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "AlertEvidence", - "ahTable": "AlertEvidence", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 40, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/63/content/items/7/content/query", - "sourceSha256": "5014049df6a062e39d058ec8a8dd718242035db12af272e5181956a41da6fadd", - "targetSha256": "5014049df6a062e39d058ec8a8dd718242035db12af272e5181956a41da6fadd" - }, - { - "sourcePath": "/items/63/content/items/8/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "0226dd4221a3b939b75d850f4478883a00977f3e7d87c446a924b2cfb3ceded0" - }, - "conversion": { - "sourceId": "/items/63/content/items/8/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query shows if the action taken after an Automated Investigation required manual approval by and admin or was automatically taken\r\nEmailPostDeliveryEvents\r\n| extend Key = strcat(NetworkMessageId , '-', RecipientEmailAddress) \r\n| summarize arg_max(Timestamp, *) by Key\r\n| where ActionType == \"Automated Remediation\"\r\n| summarize count() by ActionTrigger", - "resolvedTables": [ - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/63/content/items/8/content/query", - "sourceSha256": "0226dd4221a3b939b75d850f4478883a00977f3e7d87c446a924b2cfb3ceded0", - "targetSha256": "0226dd4221a3b939b75d850f4478883a00977f3e7d87c446a924b2cfb3ceded0" - }, - { - "sourcePath": "/items/63/content/items/9/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "914013b498753b6c0292c45e127dae55a5c25f727e651e9cd6a17c5cd31f6f9c" - }, - "conversion": { - "sourceId": "/items/63/content/items/9/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//This query visualises the daily ammount of emails that had an admin post delivery action, summarizing the data by action type\r\nlet gran = {Granularity};\r\nlet minTime = toscalar(EmailEvents | summarize min(Timestamp));\r\nlet maxTime = toscalar(EmailEvents | summarize max(Timestamp));\r\nlet agg = materialize(EmailPostDeliveryEvents\r\n| where ActionTrigger has \"AdminAction\"\r\n| summarize [\"Soft Delete\"]=countif(Action has 'Soft Delete'), [\"Hard Delete\"]=countif(Action has 'Hard Delete'), [\"Moved to junk folder\"]=countif(Action has 'Moved to junk folder'), [\"Moved to inbox\"]=countif(Action has 'Moved to inbox'), [\"Quarantine release\"]=countif(Action has 'Quarantine release') by Timestamp = bin(Timestamp, gran));\r\nrange Timestamp from bin(minTime, gran) to bin(maxTime, gran) step gran\r\n| join kind=leftouter (agg) on Timestamp\r\n| project Timestamp, [\"Soft Delete\"]=coalesce([\"Soft Delete\"],0), [\"Hard Delete\"]=coalesce([\"Hard Delete\"],0), [\"Moved to junk folder\"]=coalesce([\"Moved to junk folder\"],0), [\"Moved to inbox\"]=coalesce([\"Moved to inbox\"],0), [\"Quarantine release\"]=coalesce([\"Quarantine release\"],0)\r\n| sort by Timestamp asc", - "resolvedTables": [ - "EmailEvents", - "EmailPostDeliveryEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailPostDeliveryEvents", - "ahTable": "EmailPostDeliveryEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 15, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/63/content/items/9/content/items/1/content/query", - "sourceSha256": "914013b498753b6c0292c45e127dae55a5c25f727e651e9cd6a17c5cd31f6f9c", - "targetSha256": "914013b498753b6c0292c45e127dae55a5c25f727e651e9cd6a17c5cd31f6f9c" - }, - { - "sourcePath": "/items/64/content/items/1/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "aef89150f39c48e8af94fb3ed7258e8e02bf8d0af7ec1ad00cdecc1db1758fa7" - }, - "conversion": { - "sourceId": "/items/64/content/items/1/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Largest malicious inbound email campaigns clustered by EmailClusterId - one row per attack wave (messages, recipients, URL clicks, sender domains, threat mix, sample subjects).\r\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\r\nlet clicksByCluster = UrlClickEvents\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize UrlClicks = count() by EmailClusterId;\r\nlet qrClusters = EmailUrlInfo\r\n| where UrlLocation == \"QRCode\"\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and EmailClusterId > 0\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Messages = count(),\r\n Recipients = dcount(RecipientEmailAddress),\r\n SenderDomains = dcount(SenderFromDomain),\r\n SampleSenderDomains = make_set(SenderFromDomain, 5),\r\n ThreatTypesRaw = make_set(ThreatTypes, 50),\r\n SampleSubjects = make_set(Subject, 5),\r\n FirstSeen = min(Timestamp),\r\n LastSeen = max(Timestamp)\r\n by EmailClusterId\r\n| join kind=leftouter (clicksByCluster) on EmailClusterId\r\n| extend UrlClicks = coalesce(UrlClicks, 0)\r\n| join kind=leftouter (qrClusters) on EmailClusterId\r\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \"QR code\", \"\")\r\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \", \"), \", \"), dynamic([])))\r\n| top 20 by Messages\r\n| project ['Email Cluster ID']=EmailClusterId, ['Messages']=Messages, ['Recipients']=Recipients, ['URL Clicks']=UrlClicks, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen", - "resolvedTables": [ - "EmailEvents", - "EmailUrlInfo", - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailUrlInfo", - "ahTable": "EmailUrlInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 7, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/64/content/items/1/content/query", - "sourceSha256": "aef89150f39c48e8af94fb3ed7258e8e02bf8d0af7ec1ad00cdecc1db1758fa7", - "targetSha256": "aef89150f39c48e8af94fb3ed7258e8e02bf8d0af7ec1ad00cdecc1db1758fa7" - }, - { - "sourcePath": "/items/64/content/items/3/content/query", - "parameter": false, - "resolutionEvidence": { - "actor": "kingwil", - "reference": "Explicit approval of exact effectiveness query inputs and separate union-withsource scanner fix; prior individual approvals preserved", - "planSha256": "07f06af1c646edd8d08de65945f305fe68e2fc73f38f536fc6cdb80b0235d6cb", - "decision": "accept", - "querySha256": "0af7c322d60d2eaebbf2682473849eb391620da706669fd90fe8d98a4cd85070" - }, - "conversion": { - "sourceId": "/items/64/content/items/3/content/query", - "artifactType": "workbook", - "status": "converted", - "convertedKql": "//Malicious inbound campaigns ranked by recipient URL clicks - the attack waves that reached a mailbox and drew engagement, regardless of message volume.\r\n//URL Clicks = clicks by recipients on URLs within the campaign's messages (UrlClickEvents joined via NetworkMessageId).\r\nlet clicksByCluster = UrlClickEvents\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize UrlClicks = count() by EmailClusterId;\r\nlet qrClusters = EmailUrlInfo\r\n| where UrlLocation == \"QRCode\"\r\n| join kind=inner (EmailEvents | where EmailClusterId > 0 | distinct NetworkMessageId, EmailClusterId) on NetworkMessageId\r\n| summarize QrMessages = dcount(NetworkMessageId) by EmailClusterId;\r\nEmailEvents\r\n| where EmailDirection == \"Inbound\" and isnotempty(ThreatTypes) and EmailClusterId > 0\r\n| where OrgLevelPolicy !in (\"Phishing simulation\", \"SecOps Mailbox\")\r\n| extend Key = strcat(NetworkMessageId, \"-\", RecipientEmailAddress)\r\n| summarize arg_max(Timestamp, *) by Key\r\n| summarize Messages = count(),\r\n Recipients = dcount(RecipientEmailAddress),\r\n SenderDomains = dcount(SenderFromDomain),\r\n SampleSenderDomains = make_set(SenderFromDomain, 5),\r\n ThreatTypesRaw = make_set(ThreatTypes, 50),\r\n SampleSubjects = make_set(Subject, 5),\r\n FirstSeen = min(Timestamp),\r\n LastSeen = max(Timestamp)\r\n by EmailClusterId\r\n| join kind=inner (clicksByCluster) on EmailClusterId\r\n| where UrlClicks > 0\r\n| join kind=leftouter (qrClusters) on EmailClusterId\r\n| extend ['QR Code'] = iif(coalesce(QrMessages, 0) > 0, \"QR code\", \"\")\r\n| extend ThreatMix = array_sort_asc(set_union(split(strcat_array(ThreatTypesRaw, \", \"), \", \"), dynamic([])))\r\n| top 20 by UrlClicks\r\n| project ['Email Cluster ID']=EmailClusterId, ['URL Clicks']=UrlClicks, ['Messages']=Messages, ['Recipients']=Recipients, ['Sender Domains']=SenderDomains, ['Sample Sender Domains']=SampleSenderDomains, ['Threat Mix']=ThreatMix, ['QR Code']=['QR Code'], ['Sample Subjects']=SampleSubjects, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen", - "resolvedTables": [ - "EmailEvents", - "EmailUrlInfo", - "UrlClickEvents" - ], - "mappingTier": "1to1", - "renamedTables": {}, - "renamedAsimTables": {}, - "diff": [], - "schemaMap": [ - { - "sentinelTable": "EmailEvents", - "ahTable": "EmailEvents", - "identical": false, - "verdict": "Hard", - "score": 0.98, - "columns": [ - { - "sentinel": "AdditionalFields", - "ah": "AdditionalFields", - "laType": "dynamic", - "ahType": "string", - "relation": "compatible" - }, - { - "sentinel": "AttachmentCount", - "ah": "AttachmentCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "AuthenticationDetails", - "ah": "AuthenticationDetails", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "BulkComplaintLevel", - "ah": "BulkComplaintLevel", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "Cc", - "ah": "Cc", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "ConfidenceLevel", - "ah": "ConfidenceLevel", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Connectors", - "ah": "Connectors", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Context", - "ah": "Context", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryAction", - "ah": "DeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DeliveryLocation", - "ah": "DeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DetectionMethods", - "ah": "DetectionMethods", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "DistributionList", - "ah": "DistributionList", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailAction", - "ah": "EmailAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicy", - "ah": "EmailActionPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailActionPolicyGuid", - "ah": "EmailActionPolicyGuid", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailClusterId", - "ah": "EmailClusterId", - "laType": "long", - "ahType": "long", - "relation": "exact" - }, - { - "sentinel": "EmailDirection", - "ah": "EmailDirection", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailLanguage", - "ah": "EmailLanguage", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "EmailSize", - "ah": "EmailSize", - "laType": "int", - "ahType": "long", - "relation": "compatible" - }, - { - "sentinel": "ExchangeTransportRule", - "ah": "ExchangeTransportRule", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ForwardingInformation", - "ah": "ForwardingInformation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "InternetMessageId", - "ah": "InternetMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "IsFirstContact", - "ah": "IsFirstContact", - "laType": "bool", - "ahType": "bool", - "relation": "exact" - }, - { - "sentinel": "LastEventExecutionTime", - "laType": "datetime", - "ah": null, - "ahType": null, - "relation": "missing", - "suggestion": null, - "suggestionSource": null, - "note": "no direct AH equivalent; flag for review" - }, - { - "sentinel": "LatestDeliveryAction", - "ah": "LatestDeliveryAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "LatestDeliveryLocation", - "ah": "LatestDeliveryLocation", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "NetworkMessageId", - "ah": "NetworkMessageId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelAction", - "ah": "OrgLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "OrgLevelPolicy", - "ah": "OrgLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientDomain", - "ah": "RecipientDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientEmailAddress", - "ah": "RecipientEmailAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "RecipientObjectId", - "ah": "RecipientObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ReportId", - "ah": "ReportId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderDisplayName", - "ah": "SenderDisplayName", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromAddress", - "ah": "SenderFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderFromDomain", - "ah": "SenderFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv4", - "ah": "SenderIPv4", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderIPv6", - "ah": "SenderIPv6", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromAddress", - "ah": "SenderMailFromAddress", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderMailFromDomain", - "ah": "SenderMailFromDomain", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "SenderObjectId", - "ah": "SenderObjectId", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "Subject", - "ah": "Subject", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatClassification", - "ah": "ThreatClassification", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatNames", - "ah": "ThreatNames", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "ThreatTypes", - "ah": "ThreatTypes", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "TimeGenerated", - "ah": "TimeGenerated", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "Timestamp", - "ah": "Timestamp", - "laType": "datetime", - "ahType": "datetime", - "relation": "exact" - }, - { - "sentinel": "To", - "ah": "To", - "laType": "dynamic", - "ahType": "dynamic", - "relation": "exact" - }, - { - "sentinel": "UrlCount", - "ah": "UrlCount", - "laType": "int", - "ahType": "int", - "relation": "exact" - }, - { - "sentinel": "UserLevelAction", - "ah": "UserLevelAction", - "laType": "string", - "ahType": "string", - "relation": "exact" - }, - { - "sentinel": "UserLevelPolicy", - "ah": "UserLevelPolicy", - "laType": "string", - "ahType": "string", - "relation": "exact" - } - ], - "extraInAh": [] - }, - { - "sentinelTable": "EmailUrlInfo", - "ahTable": "EmailUrlInfo", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 7, - "note": "schema identical; no column changes" - }, - { - "sentinelTable": "UrlClickEvents", - "ahTable": "UrlClickEvents", - "identical": true, - "verdict": "Easy", - "score": 1.0, - "columnCount": 16, - "note": "schema identical; no column changes" - } - ], - "recommendations": [], - "confidence": 0.7, - "unsupported": [], - "validation": null, - "blockedReason": null - }, - "status": "converted", - "outputPath": "/items/64/content/items/3/content/query", - "sourceSha256": "0af7c322d60d2eaebbf2682473849eb391620da706669fd90fe8d98a4cd85070", - "targetSha256": "0af7c322d60d2eaebbf2682473849eb391620da706669fd90fe8d98a4cd85070" - } - ] - }, + "format": "public-workbook-v1", + "origin": "sentinel-migration", "requiredWorkloads": [ { "workload": "mdo", @@ -77548,7 +14295,8 @@ { "workload": "sentinel", "dataTypes": [ - "SecurityAlert" + "SecurityAlert", + "SecurityIncident" ] } ], @@ -77556,10 +14304,11 @@ { "connectorId": "MicrosoftThreatProtection", "dataTypes": [ - "SecurityAlert" + "SecurityAlert", + "SecurityIncident" ] } ], - "dependencyReviewRequired": false + "requiredWorkspaceFunctions": [] } }