KQL Search

Query Details

HomeAI ToolsDevice Query

Teams Emoji Reactions

Query

# Microsoft Teams Emoji Reactions

## Query Information

#### Description
This query lists the statistics of the Emoji reactions that have been send via Microsoft Teams

## Defender For Endpoint
```KQL
CloudAppEvents
| where Application == "Microsoft Teams"
| where ActionType == "ReactedToMessage"
| extend Emoji = tostring(RawEventData.MessageReactionType)
| where isnotempty(Emoji)
| summarize TotalUsage = count() by Emoji
| sort by TotalUsage
```
## Sentinel
```KQL
CloudAppEvents
| where Application == "Microsoft Teams"
| where ActionType == "ReactedToMessage"
| extend Emoji = tostring(RawEventData.MessageReactionType)
| where isnotempty(Emoji)
| summarize TotalUsage = count() by Emoji
| sort by TotalUsage
```

Explanation

This query retrieves statistics on the Emoji reactions sent via Microsoft Teams. It filters the CloudAppEvents data for reactions to messages in Microsoft Teams, extracts the Emoji type, removes any empty values, and then summarizes the total usage of each Emoji. The results are sorted by the total usage count.

Details

Bert-Jan Pals profile picture

Bert-Jan Pals

Released: December 27, 2023

Tables

CloudAppEvents

Keywords

Keywords:CloudAppEvents,Application,ActionType,ReactedToMessage,Emoji,RawEventData,MessageReactionType,isnotempty,summarize,count,sort

Operators

whereisnotemptyextendsummarizesort bycount()

Actions