error query threat hunting

[sulaimanncs915]

// Query2

// Summary of e-mail SEND to free web mail services

let timeframe = 1d;

// popular public web service domains

let emailservicedomains =dynamic (["gmail.com","outlook.com","hotmail.com","gmx.de",

"yahoo.com","mail.com","web.de","mail.ru","freenet.de","ziggo.nl","xs4all.nl",

"seznam.cz","email.cz","aol.com","hotmail.co.uk","hotmail.fr",

"msn.com","yahoo.fr","orange.fr","wanadoo.fr","comcast.net",

"yahoo.com.br","yahoo.co.in","live.com","rediffmail.com","free.fr","yandex.ru","ymail.com","libero.it",

"uol.com.br","bol.com.br","cox.net","hotmail.it","sbcglobal.net","sfr.fr","live.fr","verizon.net","live.co.uk","googlemail.com","yahoo.es",

"ig.com.br","live.nl","bigpond.com","terra.com.br","yahoo.it","neuf.fr","yahoo.de","alice.it","rocketmail.com","att.net","laposte.net",

"facebook.com","bellsouth.net","yahoo.in","hotmail.es","charter.net","yahoo.ca","yahoo.com.au","rambler.ru","hotmail.de","tiscali.it",

"shaw.ca","yahoo.co.jp","sky.com","earthlink.net","optonline.net","freenet.de","t-online.de","aliceadsl.fr",

"virgilio.it","home.nl","qq.com","telenet.be","me.com","yahoo.com.ar","tiscali.co.uk","yahoo.com.mx","voila.fr","gmx.net",

"mail.com","planet.nl","tin.it","live.it","ntlworld.com","arcor.de","yahoo.co.id","frontiernet.net","hetnet.nl","live.com.au",

"yahoo.com.sg","zonnet.nl","club-internet.fr","juno.com","optusnet.com.au","blueyonder.co.uk","bluewin.ch","highspeed.ch",

"skynet.be","sympatico.ca","windstream.net","mac.com","centurytel.net","chello.nl","live.ca","aim.com","bigpond.net.au"

"yahoo.co.uk"]);

EmailEvents

| where Timestamp > ago (timeframe)

| extend ReceipientDomain = tostring(split(RecipientEmailAddress,"@",1)[0])

| where ReceipientDomain in (emailservicedomains)

| summarize count() by ReceipientDomain

 

 

hi,

 

please help

 

An error has occurred

Error messageAn unexpected error occurred during query execution. Please try again in a few minutes.

[#2]

Hi @sulaimanncs915,

The error message "An unexpected error occurred during query execution. Please try again in a few minutes." is a generic error message that can occur for a variety of reasons.

In the case of your query, it is possible that the error is caused by the following:

• A temporary issue with the Kusto service. This could be due to a high volume of traffic or a maintenance event.
• A syntax error in the query. This could be a typo, a missing comma, or an incorrect operator.
• A permission issue. You may not have the necessary permissions to run the query.
• A bug in the Kusto service. If you have tried running the query multiple times and it continues to fail, it is possible that there is a bug in the Kusto service.

Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.

If the post was useful in other ways, please consider giving it Like.

Kindest regards,

Leon Pavesic
(LinkedIn)