Forum Discussion

dhilipan's avatar
dhilipan
Copper Contributor
Jul 16, 2023
Solved

Get Recipient domain Count for Outbound mails

Hello All, Am trying to get Recipient domain Count for Outbound mails in last 30 days and seems there is no "Recipient Domain" column in Email Events table. Only RecipientEmailAddress  column availab...
hunting
microsoft 365 defender
  • ExMSW4319's avatar
    ExMSW4319
    Jul 18, 2023

    Try:

     

    let fromdat = ago(36h);
    let todat = ago(24h);
    EmailEvents 
    | where EmailDirection == "Outbound" 
    | where Timestamp > fromdat 
    | where Timestamp < todat 
    | project RecipientEmailAddress 
    | extend RecipientDomain = split(RecipientEmailAddress,'@')[1] 
    | project RecipientDomain 
    | summarize count () by tostring(RecipientDomain) 
    | sort by count_ desc

     

    but note that this only covers a period of 12 hours. Depending on how big the tenancy is, it might not be possible to scale this up to cover the full 30 days. A query that exceeds limits could fail or give incomplete results without warning. The only option then would be to add a series of contiguous results together.

ExMSW4319's avatar
ExMSW4319
Iron Contributor
Jul 18, 2023

Try:

 

let fromdat = ago(36h);
let todat = ago(24h);
EmailEvents 
| where EmailDirection == "Outbound" 
| where Timestamp > fromdat 
| where Timestamp < todat 
| project RecipientEmailAddress 
| extend RecipientDomain = split(RecipientEmailAddress,'@')[1] 
| project RecipientDomain 
| summarize count () by tostring(RecipientDomain) 
| sort by count_ desc

 

but note that this only covers a period of 12 hours. Depending on how big the tenancy is, it might not be possible to scale this up to cover the full 30 days. A query that exceeds limits could fail or give incomplete results without warning. The only option then would be to add a series of contiguous results together.

Resources