Visualize Malware Detection Reasons
Visualization Email Malware Detection Reasons
Query
EmailPostDeliveryEvents
| where ThreatTypes == "Malware"
| extend DetectionMethod = tostring(extract(@'Malware":\["(.*?)"]', 1, DetectionMethods))
| summarize TotalEvents = count() by DetectionMethod
| render piechart with(title="Malware Detection Reason Overview")About this query
Visualize Malware Detection Reasons
Query Information
Description
This query visualizes the malware detection reasons in a piechart. This is based on the EmailPostDeliveryEvents table. This table in the advanced hunting schema contains information about post-delivery actions taken on email messages processed by Microsoft 365. Based on this information the differnt detection reasons are visualized.
References
Defender XDR
Sentinel
EmailPostDeliveryEvents
| where ThreatTypes == "Malware"
| extend DetectionMethod = tostring(extract(@'Malware":\["(.*?)"]', 1, DetectionMethods))
| summarize TotalEvents = count() by DetectionMethod
| render piechart with(title="Malware Detection Reason Overview")
Explanation
This query is designed to create a visual representation, specifically a pie chart, of the reasons why malware was detected in emails processed by Microsoft 365. Here's a simple breakdown of what the query does:
-
Data Source: It uses the
EmailPostDeliveryEventstable, which logs actions taken on emails after they have been delivered. -
Filter: The query filters the data to only include events where the threat type is identified as "Malware".
-
Extract Information: It extracts the specific method used to detect the malware from the
DetectionMethodsfield. This is done using a regular expression to capture the detection method details. -
Summarize Data: It counts the total number of events for each detection method, essentially grouping the data by the method used to detect malware.
-
Visualize: Finally, it renders this summarized data as a pie chart titled "Malware Detection Reason Overview", allowing users to easily see the distribution of different detection methods used for identifying malware in emails.
This visualization helps in understanding which detection methods are most commonly used or effective in identifying malware in email communications.
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
Keywords
Operators