Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/PurviewEnrichment.yaml [316:342]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  ( CloudAppEvents 
                      | where RawEventData.Name == 'policyViolation'
                      | extend MessageId_ = tostring(RawEventData.MessageId)
                      | extend MeetingDetailId_ = tostring(RawEventData.MeetingDetailId)
                      )
                      on MessageId_
                      | extend ChatThreadId_ = tostring(RawEventData1.ItemName)
              | join kind=inner   
                  ( CloudAppEvents
                      | where RawEventData.Operation == 'MeetingDetail'
                      | extend ChatThreadId_ = tostring(RawEventData.ChatThreadId)
                      | extend meetid = tostring(RawEventData.Id)
                      ) on ChatThreadId_
                      | extend Meeting = tostring(parse_json(tostring(parse_json(tostring(RawEventData.ExchangeMetaData)).To))[0])
                      | extend PolicyName = tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].PolicyName)
                      | extend RuleName = tostring(parse_json(tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].Rules))[0].RuleName)
                      | extend SensitiveInformationTypeName = tostring(parse_json(tostring(parse_json(tostring(parse_json(tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].Rules))[0].ConditionsMatched)).SensitiveInformation))[0].SensitiveInformationTypeName)
              | project meetid,Meeting,PolicyName,RuleName,SensitiveInformationTypeName,UserId_
              | join kind=inner
                  (    
                  CloudAppEvents
                  | where RawEventData.Operation == 'MeetingParticipantDetail'
                  | extend meetid = tostring(RawEventData.MeetingDetailId)
                  )
                  on meetid
              | extend UPN = tostring(parse_json(tostring(RawEventData.Attendees))[0].UPN)
              | extend RecipientType = tostring(parse_json(tostring(RawEventData.Attendees))[0].RecipientType)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/PurviewEnrichment.yaml [668:694]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  ( CloudAppEvents 
                      | where RawEventData.Name == 'policyViolation'
                      | extend MessageId_ = tostring(RawEventData.MessageId)
                      | extend MeetingDetailId_ = tostring(RawEventData.MeetingDetailId)
                      )
                      on MessageId_
                      | extend ChatThreadId_ = tostring(RawEventData1.ItemName)
              | join kind=inner 
                  ( CloudAppEvents
                      | where RawEventData.Operation == 'MeetingDetail'
                      | extend ChatThreadId_ = tostring(RawEventData.ChatThreadId)
                      | extend meetid = tostring(RawEventData.Id)
                      ) on ChatThreadId_
                      | extend Meeting = tostring(parse_json(tostring(parse_json(tostring(RawEventData.ExchangeMetaData)).To))[0])
                      | extend PolicyName = tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].PolicyName)
                      | extend RuleName = tostring(parse_json(tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].Rules))[0].RuleName)
                      | extend SensitiveInformationTypeName = tostring(parse_json(tostring(parse_json(tostring(parse_json(tostring(parse_json(tostring(RawEventData.PolicyDetails))[0].Rules))[0].ConditionsMatched)).SensitiveInformation))[0].SensitiveInformationTypeName)
              | project meetid,Meeting,PolicyName,RuleName,SensitiveInformationTypeName,UserId_
              | join kind=inner
                  (    
                  CloudAppEvents
                  | where RawEventData.Operation == 'MeetingParticipantDetail'
                  | extend meetid = tostring(RawEventData.MeetingDetailId)
                  )
                  on meetid
              | extend UPN = tostring(parse_json(tostring(RawEventData.Attendees))[0].UPN)
              | extend RecipientType = tostring(parse_json(tostring(RawEventData.Attendees))[0].RecipientType)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



