gistfile1.txt

Descriptor:
  Name: EmailHuntingCustomKQL
  DisplayName: Defender KQL for email discovery
  Description: Skills to query email logs in M365 Advanced Hunting

SkillGroups:
  - Format: KQL
    Skills:
      - Name: GetLatestEmailsByRecipientSender
        DisplayName: Get Latest Emails By Recipient or Sender
        Description: Fetches the latest emails received or send by the user with the specified email address
        Inputs:
          - Name: email
            Description: The email address of the recipient or sender
            Required: true
        Settings:
          Target: Defender
          Template: |-
            EmailEvents
            | where RecipientEmailAddress =~ '{{email}}' or SenderMailFromAddress =~ '{{email}}'
            | project Timestamp, NetworkMessageId, SenderFromAddress, SenderDisplayName, Subject, DeliveryLocation
            | top 100 by Timestamp desc