KQL Search

Query Details

HomeAI ToolsDevice Query

Device Summarize Smart Screen Phishing Domains

Query

//Summarize the domains that Smartscreen is blocking as phishing attempts

//Data connector required for this query - M365 Defender - Device* tables

DeviceEvents
| where TimeGenerated > ago (30d)
| where ActionType startswith "SmartScreen"
| extend SmartScreenExperience = tostring(AdditionalFields.Experience)
| where AdditionalFields.Experience == "Phishing"
| parse-where RemoteUrl with * '://' RemoteDomain '/' *
| summarize Count=count()by RemoteDomain
| sort by Count

Explanation

This query summarizes the domains that Smartscreen is blocking as phishing attempts. It uses the M365 Defender - Device* tables as the data source. It filters the DeviceEvents table for events that occurred in the last 30 days and have an ActionType starting with "SmartScreen". It then extends the SmartScreenExperience field and filters for events where the experience is "Phishing". The query parses the RemoteUrl field to extract the RemoteDomain and then summarizes the count of occurrences for each domain. The results are sorted by the count in ascending order.

Details

Matt Zorich profile picture

Matt Zorich

Released: June 17, 2022

Tables

DeviceEvents

Keywords

DeviceEvents,TimeGenerated,ActionType,SmartScreenExperience,AdditionalFields.Experience,RemoteUrl,RemoteDomain,Count

Operators

whereagostartswithextendwhere==parse-wherewith*'://'/summarizecount()bysort by

Actions