// Illustrative only; not executed against a tenant.
// Microsoft Defender XDR: EmailEvents. Subject/display-name triage, not body inspection.
let Start = datetime(2026-09-28T00:00:00Z);
let End = datetime(2026-10-18T00:00:00Z);
EmailEvents
| where Timestamp >= Start and Timestamp < End
| where EmailDirection == "Inbound"
| extend Text = strcat(Subject, " ", SenderDisplayName)
| where (Text contains "ヤマト" or Text contains "クロネコ"
        or Text contains "yamato" or Text contains "kuroneko")
    and (Text contains "口座" or Text contains "振込先"
        or Text contains "加盟店" or Text contains "精算"
        or Text contains "bank account" or Text contains "settlement"
        or Text contains "merchant" or Text contains "refund")
| project Timestamp, NetworkMessageId, SenderFromAddress, SenderFromDomain,
          Subject, RecipientEmailAddress, DeliveryAction
| order by Timestamp desc