# Trouble Shooting

Review the Defender Advanced Hunting examples for DMARC, SPF and DKIM failures, including the recorded SendGrid and Oliver investigation notes. The queries are diagnostic references, not confirmed incident findings.

!!!warning Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
!!!

Link: [Advanced hunting - Microsoft Defender](https://security.microsoft.com/v2/advanced-hunting?tid=912e9bd6-236e-46f5-9c0c-b99867e6b99b)

## Using Advanced Hunting Kusto Queries to Find Issues

**NOTE:** If "ago"(Example: where Timestamp \>= ago(14d) ) is used the timeframe used by the query window will be set to "Set in query"

[Screenshot retained for review](../../review/Review-status.md#asset-a8f070dc1b0e81a5122d)

**DMARC FAILS**\*\*: WHERE SPF PASS AND DKIM PASS\*\*

- Typically happens with mass emailing systems. Possible that DKIM for the mass emailing system has not been added to the school domain you are trying to send from.
- To check go to [Find Schools Missing DKIM for SendGrid](dkim.md)

EmailEvents

\| where Timestamp \>= ago(2d)

\| extend AuthDetails = parse_json(AuthenticationDetails)

\| extend DMARCTestResult = tostring(AuthDetails.DMARC)

\| extend SPFTestResult = tostring(AuthDetails.SPF)

\| extend DKIMTestResult = tostring(AuthDetails.DKIM)

\| where SPFTestResult == "pass" and DKIMTestResult == "pass"

\| where DMARCTestResult == "fail"

\| extend SenderDomain = tostring(split(SenderFromAddress, "@")\[1\])

\| where SenderDomain endswith "edu.au"

\| extend RecipientDomain = tostring(split(RecipientEmailAddress, "@")\[1\])

\| extend IPv4 = tostring(SenderIPv4)

\| summarize EmailCount = count() by DMARCTestResult,SenderDomain,SPFTestResult,DKIMTestResult,IPv4,SenderMailFromAddress

\| sort by DMARCTestResult,EmailCount

SPF FAIL FOR OLIVER: Count of Pass/Fails

**Getting the list of allow IP senders for Oliver** Oliver has 32 IP addresses that are using up

You can use this **Write-Host** line to create OliverIpAddresses variable that is used at the start of the Kusto Query

Write-Host "let OliverIpAddresses = dynamic(\[""$($(Get-XSPFIPAddresses -domain "spf.softlinkhosting.com.au" \| foreach {Get-XIpRange \$\_ -quiet -rangeOnly}) -join '", "')""\])"

## Related guidance

- [Topic overview](Introduction.md)
- [Source review status](../../review/Review-status.md)