KQL to calculate Tenant External Recipient Rate Limit.kql

SlimKQL · Feb 25, 2025 · a5aff68 · a5aff68
1 parent 91bfbfb
commit a5aff68
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/DefenderXDR/KQL to calculate Tenant External Recipient Rate Limit.kql b/DefenderXDR/KQL to calculate Tenant External Recipient Rate Limit.kql
@@ -0,0 +1,9 @@
+// Tenant External Recipient Rate Limit or TERR
+// 
+
+EmailEvents
+| where Timestamp > ago(30d)
+| where EmailDirection == "Outbound"
+| summarize OutboundEmailVol=count() by bin(Timestamp,1d)
+| sort by OutboundEmailVol desc 
+