EmailEvents
| where SenderMailFromDomain == RecipientDomain
| where isempty(Connectors)
| where DeliveryAction !in ("Junked", "Blocked")
| extend AuthenticationDetails = parse_json(AuthenticationDetails)
| where AuthenticationDetails.DMARC == "fail"
EmailEvents
| where SenderMailFromDomain == RecipientDomain
| where isempty(Connectors)
| where DeliveryAction !in ("Junked", "Blocked")
| extend AuthenticationDetails = parse_json(AuthenticationDetails)
| where AuthenticationDetails.DMARC == "fail"