Quarantine Release Email Details

Description

This query shows information about email that has been released from the Quarantine in Defender for Office 365.

Query · kql

CloudAppEvents 
| where ActionType == "QuarantineReleaseMessage"
| project ReleaseTime = Timestamp, ResultStatus = RawEventData.ResultStatus, ActionType, ReleasedBy = tostring(RawEventData.UserId), NetworkMessageId = tostring(RawEventData.NetworkMessageId), ReleaseTo = RawEventData.ReleaseTo
| join kind=inner (
  EmailEvents
  | project-rename EmailTime = Timestamp
  ) on NetworkMessageId
| project-away NetworkMessageId1
| order by ReleaseTime asc
Raw source Quarantine Release Email Details · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 6f96f6d7-d972-421e-a59f-6b9a8de81324
name: Quarantine Release Email Details
description: |
  This query shows information about email that has been released from the Quarantine in Defender for Office 365.
description-detailed: |
  This query shows information about email that has been released from the Quarantine in Defender for Office 365. The details include the time each email was released and who it was released by.
  Reference - https://learn.microsoft.com/en-us/defender-office-365/quarantine-admin-manage-messages-files
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
      - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents 
  | where ActionType == "QuarantineReleaseMessage"
  | project ReleaseTime = Timestamp, ResultStatus = RawEventData.ResultStatus, ActionType, ReleasedBy = tostring(RawEventData.UserId), NetworkMessageId = tostring(RawEventData.NetworkMessageId), ReleaseTo = RawEventData.ReleaseTo
  | join kind=inner (
    EmailEvents
    | project-rename EmailTime = Timestamp
    ) on NetworkMessageId
  | project-away NetworkMessageId1
  | order by ReleaseTime asc
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.