Group quarantine release

Description

This query helps in reviewing group Quarantine released messages by detection type. Useful to see what is leading to the largest number of messages being released.

Query · kql

CloudAppEvents 
| where ActionType == "QuarantineReleaseMessage"
| extend parsed=parse_json(RawEventData)
| extend NetworkMessageId = tostring(parsed.NetworkMessageId)
| join EmailEvents on NetworkMessageId
| summarize count() by DetectionMethods
| order by count_ desc
Raw source Group quarantine release · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: a12cac64-ea6d-46d4-91a6-262b165fb9ad
name: Group quarantine release
description: |
  This query helps in reviewing group Quarantine released messages by detection type. Useful to see what is leading to the largest number of messages being released.
description-detailed: |
  This query helps in reviewing group Quarantine released messages by detection type in Defender for Office 365. Useful to see what is leading to the largest number of messages being released.
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - EmailEvents
      - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents 
  | where ActionType == "QuarantineReleaseMessage"
  | extend parsed=parse_json(RawEventData)
  | extend NetworkMessageId = tostring(parsed.NetworkMessageId)
  | join EmailEvents on NetworkMessageId
  | summarize count() by DetectionMethods
  | order by count_ desc
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.