Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

User reported messages data table

Iron Contributor

Hi,

 

I'm using the "Submissions" page on Defender to reply (with custom messages) to our users who report some email as phishing. On the portal, I can see if the report has been already replied or not on the field "Marked as", which has the value "Doesn't apply" whenever no one replied yet.

I want to extract some metrics daily to check if all reported messages have had a reply for example. But I don't know where can I get this data from.

 

Do you know in which table I can find this data to create some hunting queries?

 

Thanks

5 Replies

@dmarquesgn 
The table inside Advanced hunting with submission events is CloudAppEvents. 
The events are denoted as ActionType and the specific action are "SubmissionAdminReview" and "UserSubmission"

 

"UserSubmission" action is triggered whenever user report is done.

"SubmissionAdminReview" action is triggered whenever admin reviews the user report.

 

a sample query is 

CloudAppEvents
| where  ActionType  == "SubmissionAdminReview"
| take 100

 

@Dhairyya_Agarwal 

Thanks for the tip. I'm already looking into it.

By the way, do you have an idea of what's the field that match both submission and admin review?

The goal is to understand which messages were not yet reviewed.

 

Thanks

@dmarquesgn Check out submission id or message reported id

@Dhairyya_Agarwal 

Thanks. I've confirmed that "SubmissionID" is the one.

I'm trying to achieve the following, I want to extract periodically, daily for example, a list of User submitted messages which had not yet had a reply, or an Admin Submission. I'm trying to think how can I build that on a KQL query. The logic needed is to search for all User Reported "SubmissionID" and check for each if there is an Admin Submitted "SubmissionID" and just write down those who doesn't have.

I'm kind of new to KQL. Is this something achievable in KQL?

Thanks

You have to join the concept of outer join where the outer data is all user report and inner data is user report which has been marked and notified.