Quarantine Release Percentage

id: 5fb333a4-39bb-474b-ab37-9efdca8e9182
name: Quarantine Release Percentage
description: |
  This query calculates the percentage of quarantined emails that were subsequently released, out of the total quarantined.
description-detailed: |
  This query calculates the percentage of quarantined emails in Microsoft Defender for Office 365 that were subsequently released (EmailPostDeliveryEvents Action == "Quarantine release") out of the total quarantined (EmailEvents DeliveryLocation == "Quarantine"). The percentage is guarded against a zero denominator.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - EmailPostDeliveryEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let Quarantine_Releases = toscalar(EmailPostDeliveryEvents
  | where Timestamp > ago(30d)
  | where Action == "Quarantine release"
  | distinct NetworkMessageId, RecipientEmailAddress
  | count);
  let Quarantined_Mailflow = toscalar(EmailEvents
  | where Timestamp > ago(30d)
  | where DeliveryLocation == "Quarantine"
  | distinct NetworkMessageId, RecipientEmailAddress
  | count);
  print
  Quarantine_Releases = toreal(Quarantine_Releases),
  Quarantined_Mailflow = toreal(Quarantined_Mailflow),
  Release_Percentage = iff(Quarantined_Mailflow == 0, 0.0, round((toreal(Quarantine_Releases) / toreal(Quarantined_Mailflow)) * 100, 2))
version: 1.0.0