Announcing quarantine release integration in Microsoft Defender for Office 365 hunting experience!!

That KQL query mentioned. It doesn't seem to be picking up all instances for where a URL was seen as Phishing in an email (in my example below, I found over 10 emails affected)

MS started (as of today) to flag the below URL as Phishing , but when I ran the below KQL as shown above, it only picked up one email. Previously, that URL (where someone has accepted a Teams meeting) was never flagged

URL: hxxps://http://www.google[.]com/maps/search/Microsoft+Teams+Meeting?hl=en

Query ran: (defanged URL in query)

EmailEvents
| where ThreatTypes contains "Phish" and LatestDeliveryLocation contains "Quarantine"
| join EmailUrlInfo on NetworkMessageId
| where Url in ("hxxps://www[.]google.com/maps/search/Microsoft+Teams+Meeting?hl=en")
| project Timestamp,NetworkMessageId,RecipientEmailAddress,Subject,DeliveryAction,LatestDeliveryLocation,Url,UrlCount, ReportId

When running the same URL via Explorer in Defender, it found them all.