Quarantine release trend

Description

This query helps reviewing quarantine release trend in Defender for Office 365

Query · kql

CloudAppEvents
| where ActionType == "QuarantineReleaseMessage"
| summarize count() by bin(Timestamp, 1d)
| project-rename Releases = count_
| render timechart with (title="Quarantine Releases by Day")
Raw source Quarantine release trend · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 9f135aef-ad25-4df2-bdab-8399978a36a2
name: Quarantine release trend
description: |
  This query helps reviewing quarantine release trend in Defender for Office 365
description-detailed: |
  This query helps reviewing quarantine release trend in Defender for Office 365
  Reference - https://learn.microsoft.com/en-us/defender-office-365/quarantine-admin-manage-messages-files
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "QuarantineReleaseMessage"
  | summarize count() by bin(Timestamp, 1d)
  | project-rename Releases = count_
  | render timechart with (title="Quarantine Releases by Day")
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.