KQL Search

This query is designed to identify email events involving addresses associated with the ".onion" domain, which is typically used for anonymous communication over the Tor network. Here's a simple breakdown of what the query does:

1. Data Import: It imports a list of ".onion" email addresses from an external CSV file hosted on GitHub. This list is stored in a variable called OnionMailAddresses.

2. Email Filtering: It then filters email events from a dataset called EmailEvents. The filter checks if the sender's domain or the recipient's email address matches any of the ".onion" addresses in the imported list.

3. Purpose: The goal is to identify and possibly block emails that involve ".onion" addresses, which could be associated with anonymous or potentially suspicious activities. The comment in the query provides a link to a script that can be used for blocking such emails.