Automated Remediation Manual versus Automatic Approval

id: 6782a329-feee-4dbc-bbca-d31cb12e1437
name: Automated Remediation Manual versus Automatic Approval
description: |
  This query shows whether Microsoft Defender for Office 365 automated remediation actions were taken automatically or required manual admin approval, using the EmailPostDeliveryEvents table.
description-detailed: |
  Automated Investigation and Response actions can be fully automatic or held for manual approval. This query breaks down automated remediation events by their trigger (automatic versus manual approval), deduplicated to the latest event per message and recipient, so teams can understand how much of their remediation is hands-off versus analyst-gated.
  Query is also included as part of the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailPostDeliveryEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailPostDeliveryEvents
  | where Timestamp > ago(30d)
  | extend Key = strcat(NetworkMessageId, '-', RecipientEmailAddress)
  | summarize arg_max(Timestamp, *) by Key
  | where ActionType == "Automated Remediation"
  | summarize count() by ActionTrigger
  | render piechart
version: 1.0.0