Cloud App Events No Threats Found By AIR Investigation In Phishing Submission
Query
CloudAppEvents
| where ActionType == "AirInvestigationData"
| extend
Status = tostring(RawEventData["Status"]),
InvestigationId = tostring(RawEventData["InvestigationId"]),
InvestigationType = tostring(RawEventData["InvestigationType"]),
InvestigationName = tostring(RawEventData["InvestigationName"]),
Data = todynamic(tostring(RawEventData["Data"]))
| where InvestigationType == "SubmissionInvestigation" and InvestigationName has "User reported message as malicious" and Status == "No threats found"
| extend
AlertType = tostring(Data["AlertType"]),
AlertId = strcat("fa", tostring(Data["ProviderAlertId"])),
InternetMessageId = tostring(Data["Entities"][0]["InternetMessageId"]),
NetworkMessageId = tostring(Data["Entities"][0]["NetworkMessageId"]),
SenderFromAddress = tostring(Data["Entities"][0]["Sender"]),
RecipientEmailAddress = tostring(Data["Entities"][0]["Recipient"]),
Subject = tostring(Data["Entities"][0]["Subject"])
| where AlertType == "b26a5770-0c38-434a-9380-3a3c2c27bbb3" and isnotempty(NetworkMessageId) and isnotempty(SenderFromAddress) and isnotempty(RecipientEmailAddress) and isnotempty(Subject)Explanation
This query is analyzing cloud application events to identify specific investigations related to user-reported messages. Here's a simplified breakdown of what the query does:
-
Filter Events: It starts by filtering events from the
CloudAppEventstable where theActionTypeis "AirInvestigationData". -
Extract and Convert Data: It extracts and converts several fields from the
RawEventData:StatusInvestigationIdInvestigationTypeInvestigationNameData(converted to a dynamic object)
-
Further Filtering: It narrows down the results to investigations that:
- Are of type "SubmissionInvestigation".
- Have a name containing "User reported message as malicious".
- Have a status of "No threats found".
-
Extract Additional Details: For these filtered investigations, it extracts additional details from the
Datafield:AlertTypeAlertId(constructed by prefixing "fa" to theProviderAlertId)InternetMessageIdNetworkMessageIdSenderFromAddressRecipientEmailAddressSubject
-
Final Filtering: It further filters the results to include only those where:
AlertTypematches a specific GUID ("b26a5770-0c38-434a-9380-3a3c2c27bbb3").NetworkMessageId,SenderFromAddress,RecipientEmailAddress, andSubjectare not empty.
In summary, this query is designed to find specific user-reported messages that were investigated and found to have no threats, focusing on a particular alert type and ensuring certain message details are present.
Details
Jose Sebastián Canós
Released: July 29, 2026
Tables
Keywords
Operators