User Profile
davinelm
Copper Contributor
Joined 3 years ago
User Widgets
Recent Discussions
Quantity of bad emails vs legit email query
Hello, I'm trying to create a kql hunting query that will display the total number of bad emails (malware, spam, phishing) but am having some trouble combining the columns of various bad emails together in one and getting a total count. The screen grab below shows the first 6 columns that i want to collapse into. my query in total is this so far: let vip = pack_array("email address removed for privacy reasons"); EmailEvents | where RecipientEmailAddress has_any (vip) | project RecipientEmailAddress, ThreatTypes | evaluate pivot(ThreatTypes)
