// Microsoft Defender XDR Advanced Hunting; read-only; not live-tested.
// Replace the message ID copied from Defender. Lookback: 7 days.
let MessageId = "REPLACE_WITH_NETWORK_MESSAGE_ID";
EmailEvents
| where Timestamp >= ago(7d)
| where NetworkMessageId == MessageId
| summarize arg_max(Timestamp, *) by NetworkMessageId, RecipientEmailAddress
| project Timestamp, NetworkMessageId, RecipientEmailAddress,
    SenderFromAddress, Subject, DeliveryAction, DeliveryLocation
| order by Timestamp desc
| take 500