Assistance with creating a KQL script for Microsoft Purview

Brendan Short 0

I need help creating a KQL script for Microsoft Purview. My organisation needs to see all emails sent from Outlook with an attachment that were external to our network domain. I'm not a programmer, but I've already started a case in eDiscovery Premium, added my custodians and data source, and now need to set up my collection. Specifically, I need to add a KQL script to instruct Purview on what to search for. I would like the script to identify emails with attachments sent externally from our network to other email addresses and ignore emails sent with an attachment internally through our network/domain. Once I have a working KQL script, I can export the results to a review set. Any help with the required script is greatly appreciated.

NIKHILA NETHIKUNTA 1,920 Reputation points Microsoft Vendor

2024-08-26T04:21:24.6066667+00:00

Hi @Brendan Short
Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

1 answer

Pauline Mbabu 250 Reputation points Microsoft Employee

2024-08-23T11:19:19.5566667+00:00

Hello @Brendan Short ,
I followed this doc https://learn.microsoft.com/en-us/purview/ediscovery-keyword-queries-and-search-conditions#recipient-expansion AND https://learn.microsoft.com/en-us/purview/ediscovery-kql-editor to try and create a Query that suits your scenario.

Query one:
(Type=Email) AND (Recipients<>"yourdomain.com") AND (HasAttachment=true)
This Query will return Emails that have attachments that are sent to receipts that are not in your domain.

The Documentation doesn't give any direction of getting emails that are specifically sent from your domain. It only gives the option to use Participants which will return messages sent by or sent to a user in the specified domain.
Using this the field will look like below:
(Type=Email) AND (Participants:"your domain" AND Recipients<>"your domain") AND (HasAttachment=true)

I hope this gives you better context on this.
Please sign in to rate this answer.
Brendan Short 0 Reputation points

2024-08-26T23:12:02.8566667+00:00

Hi @pauline mbabu

When I use the provided script above I receive the following errors.

Could you please advise what I am doing wrong.

NIKHILA NETHIKUNTA 1,920 Reputation points Microsoft Vendor

2024-08-27T15:14:25.4533333+00:00

@Brendan Short
As per the screenshot you have provided, you need to replace "yourdomain.com" with the sender's domain which is from your internal domain in the first case.
In the second case, please replace it with recipient's domain which is not in your internal domain.
Replace the values and try running the script. Please let us know if the issue still persists.

Brendan Short 0 Reputation points

2024-08-28T03:53:07.8933333+00:00

Hi NIKHILANETHIKUNTA

I think you are confused as to what I want to do.

I have updated the script with the details of my internal domain, however I don't want to see the details from a particular external domain, I want to see ALL emails that have attachments that are sent to ANY external email address.

When I use the script above and update the first "yourdomain.com" with the details of my domain, it still shows the syntax errors. The script does not like = > == and !=

I still do not have a working solution.

NIKHILA NETHIKUNTA 1,920 Reputation points Microsoft Vendor

2024-08-28T06:58:39.0866667+00:00

@Brendan Short

Please retry with the below query and let me know if you have any issues:

EmailEvents | where hasAttachments == true | where SenderFromDomain == "yourdomain.com" | where not ( RecipientEmailDomain endsWith "yourdomain.com") | project SenderEmailAddress, RecipientEmailAddress, Subject, AttachmentCount, Timestamp

Hope this helps. Please let us know if you have any further questions.

Pauline Mbabu 250 Reputation points Microsoft Employee

2024-08-29T16:53:20.45+00:00

Kindly check the revised answer, the answer that was previously given only works for a different platform and not on Content Search.

NIKHILA NETHIKUNTA 1,920 Reputation points Microsoft Vendor

2024-09-02T06:01:29.62+00:00

@Brendan Short
Just checking in to see if the above revised answer provided by @Pauline Mbabu helped.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Brendan Short 0 Reputation points

2024-09-03T00:25:29.5566667+00:00

Hi @NIKHILA NETHIKUNTA and @Pauline Mbabu

I am wanting a KQL script for EDISCOVERY, not CONTENT SEARCH.

CONTENTSEARCH does not allow me to see the attachments sent externally from our organisations domain/network.

I am still receiving errors when attempting to use the new script provided above.

I am fully aware that "yourdomain.com" needs to be updated with the details of my organisational domain. I am not providing this detail for security reasons.

This is a screenshot of the same "Potential syntax errors" that I receive when attempting to use the latest KQL script provided.

Can you please advise why all the KQL scripts provided do not work?

Brendan Short 0 Reputation points

2024-09-03T00:35:21.6866667+00:00

.....

Brendan Short 0 Reputation points

2024-09-03T02:38:23.2066667+00:00

I have made some amendments to the script provided as shown below.

EmailEvents

| where hasAttachments true

| where SenderFromDomain “REDACTED.COM”

| where NOT ( RecipientEmailDomain endsWith “REDACTED.COM”)

| project SenderEmailAddress, RecipientEmailAddress, Subject, AttachmentCount, Timestamp

After running the script, there is no data found.

Any advice would be appreciated.

NIKHILA NETHIKUNTA 1,920 Reputation points Microsoft Vendor

2024-09-03T09:34:02.08+00:00

@Brendan Short
I agree that this issue looks strange and I wasn't able to reproduce this issue. If you have a support plan could you please file a support ticket for deeper investigation and do share the SR# with us? In case if you don't have a support plan please let us know here.

Brendan Short 0 Reputation points

2024-09-13T01:41:19.2433333+00:00

No. We don't have a support plan with Microsoft.

Pauline Mbabu 250 Reputation points Microsoft Employee

2024-09-16T14:36:15.6666667+00:00

Hello Brendan,

Were you able to try the queries that I posted earlier that are based on this eDiscovery Key Word Queries and Search conditions doc.
https://learn.microsoft.com/en-us/purview/ediscovery-keyword-queries-and-search-conditions
Based on this doc,
(Type=Email) AND (Recipients<>"yourdomain.com") AND (HasAttachment=true) This Query should return Emails that have attachments that are sent to receipts that are not in your domain.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Assistance with creating a KQL script for Microsoft Purview

1 answer

Your answer