KQL Search

This KQL (Kusto Query Language) query is designed to analyze Microsoft OneNote files that have been sent as email attachments to your organization's email system over the past 90 days. Here's a simple breakdown of what the query does:

1. EmailAttachmentInfo: This table contains information about email attachments.
2. Time Filter: The query filters for records generated in the last 90 days.
3. File Type Filter: It specifically looks for attachments with the file type "one" or "onenote" (which are associated with Microsoft OneNote files).
4. Join Operation: It joins the filtered attachment data with the EmailEvents table based on the NetworkMessageId. This allows you to correlate the attachment information with the corresponding email events.

In summary, this query helps you identify and analyze OneNote files that have been sent as email attachments to your organization in the last 90 days.