Extract domains in cc recipients and match against M365 owned domains

KQL

Draft

let OwnedDomains = dynamic([
// doublequoted and comma-separated domains here //
]);
EmailEvents
| where array_length(Cc) != 0
| extend CcCount = array_length(Cc)
// | mv-expand Cc
// | extend CcDomain = extract("\\@.+", 0, tostring(Cc))
// | extend CcDomain = extract(@"<([^>]+)>", 0, tostring(Cc))
| extend CcDomain = extract_all("<.*@(.*?)>", tostring(Cc))
| where CcCount > 25 and CcDomain has_any(OwnedDomains) and SenderFromDomain has_any(OwnedDomains)
| distinct CcCount, SenderFromAddress, SenderFromDomain
| sort by CcCount, SenderFromAddress desc
//| where CcCount > 25 and Cc contains("@vu.nl")// and EmailDirection != "Inbound"
//| distinct CcCount, SenderMailFromAddress, SenderFromDomain, CcDomain// , Subject, //, EmailDirection
//| sort by CcCount, SenderMailFromAddress desc

Final

let OwnedDomains = dynamic([
// doublequoted and comma-separated domains here //
]);
EmailEvents
| where array_length(Cc) != 0
| extend CcCount = array_length(Cc)
| extend CcDomain = extract_all("<.*@(.*?)>", tostring(Cc))
| where CcCount > 25 and CcDomain has_any(OwnedDomains) and SenderFromDomain has_any(OwnedDomains)
| distinct CcCount, SenderFromAddress, SenderFromDomain
| sort by CcCount, SenderFromAddress desc