Forum Discussion

dmarquesgn's avatar
dmarquesgn
Iron Contributor
Mar 28, 2024

User reported messages data table

Hi,   I'm using the "Submissions" page on Defender to reply (with custom messages) to our users who report some email as phishing. On the portal, I can see if the report has been already replied or...
submissions
Dhairyya_Agarwal's avatar
Dhairyya_Agarwal
Icon for Microsoft rankMicrosoft
Mar 29, 2024

dmarquesgn 
The table inside Advanced hunting with submission events is CloudAppEvents. 
The events are denoted as ActionType and the specific action are "SubmissionAdminReview" and "UserSubmission"

 

"UserSubmission" action is triggered whenever user report is done.

"SubmissionAdminReview" action is triggered whenever admin reviews the user report.

 

a sample query is 

CloudAppEvents
| where  ActionType  == "SubmissionAdminReview"
| take 100

 

  • dmarquesgn's avatar
    dmarquesgn
    Iron Contributor
    Mar 30, 2024

    Dhairyya_Agarwal 

    Thanks for the tip. I'm already looking into it.

    By the way, do you have an idea of what's the field that match both submission and admin review?

    The goal is to understand which messages were not yet reviewed.

     

    Thanks

      • dmarquesgn's avatar
        dmarquesgn
        Iron Contributor
        Apr 01, 2024

        Dhairyya_Agarwal 

        Thanks. I've confirmed that "SubmissionID" is the one.

        I'm trying to achieve the following, I want to extract periodically, daily for example, a list of User submitted messages which had not yet had a reply, or an Admin Submission. I'm trying to think how can I build that on a KQL query. The logic needed is to search for all User Reported "SubmissionID" and check for each if there is an Admin Submitted "SubmissionID" and just write down those who doesn't have.

        I'm kind of new to KQL. Is this something achievable in KQL?

        Thanks

Resources