index="REPLACE_WITH_O365_INDEX" sourcetype="o365:reporting:messagetrace" earliest="10/02/2026:00:00:00"
| eval sender_domain=lower(mvindex(split(SenderAddress, "@"), 1))
| where match(Subject, "(?i)pharma ?digital|ファーマデジタル|医薬情報ネット|REPLACE_WITH_YOUR_PORTAL_NAME")
| where NOT match(sender_domain, "(^|\.)(asahi-kasei\.co\.jp|akp-pharma-digital\.com|pin-japan\.com|pin-japan\.co\.jp)$")
| stats count AS messages dc(RecipientAddress) AS recipients min(_time) AS first_seen max(_time) AS last_seen BY SenderAddress Subject Status
| convert ctime(first_seen) ctime(last_seen)
| sort 0 first_seen