Forum Discussion

dmarquesgn's avatar
dmarquesgn
Iron Contributor
Mar 28, 2024

User reported messages data table

Hi,   I'm using the "Submissions" page on Defender to reply (with custom messages) to our users who report some email as phishing. On the portal, I can see if the report has been already replied or...
submissions
dmarquesgn's avatar
dmarquesgn
Iron Contributor
Mar 30, 2024

Dhairyya_Agarwal 

Thanks for the tip. I'm already looking into it.

By the way, do you have an idea of what's the field that match both submission and admin review?

The goal is to understand which messages were not yet reviewed.

 

Thanks

  • dmarquesgn's avatar
    dmarquesgn
    Iron Contributor
    Apr 01, 2024

    Dhairyya_Agarwal 

    Thanks. I've confirmed that "SubmissionID" is the one.

    I'm trying to achieve the following, I want to extract periodically, daily for example, a list of User submitted messages which had not yet had a reply, or an Admin Submission. I'm trying to think how can I build that on a KQL query. The logic needed is to search for all User Reported "SubmissionID" and check for each if there is an Admin Submitted "SubmissionID" and just write down those who doesn't have.

    I'm kind of new to KQL. Is this something achievable in KQL?

    Thanks

    • Dhairyya_Agarwal's avatar
      Dhairyya_Agarwal
      Icon for Microsoft rankMicrosoft
      Apr 01, 2024
      You have to join the concept of outer join where the outer data is all user report and inner data is user report which has been marked and notified.

Resources