Forum Discussion
Solved
Office 365 Spam detections Report
Good day all and happy Friday!
I see that spam reports has become much more informative, but this is the thing:
When I'm trying to hunt around about spam report, I have only option to choose Content filtered report. Only blue line with this report can be selected (clickable). However I see SMTP blocked, IP blocked, Directory blocked in the right of my report but where are all these data? In real time report (by hitting the blue line) or even after this report was scheduled and sent on my email I've only content filtered data in Event type ID column.
How can I quickly find these 1500 blocked IP if I have to review it or provide this information to the security officer? I have only content filter in all of my tenants, and no columns with SMTP blocked or IP blocked senders. Please help.
PS. I hope that Vasil M. will find my question interesting ^^_
You can't, most of these are blocked even before hitting the Exchange servers, so there is no information available in any report. Third party tools included.
If you need "official" answer, the details are here: https://technet.microsoft.com/en-us/library/dn500744(v=exchg.150).aspx
You can't, most of these are blocked even before hitting the Exchange servers, so there is no information available in any report. Third party tools included.
If you need "official" answer, the details are here: https://technet.microsoft.com/en-us/library/dn500744(v=exchg.150).aspx
That seems like a shortcoming. If the system knows enough to show you on a report that 1689 messages were "IP blocked" it should be able to give details on each of those messages explaining why. The data is obviously logged somewhere. It needs to be exposed to admins. As it stands we have no visibility into the details of the vast majority of blocked messages.
Well, do you really want to have a list of all the gazillion messages from that random well-known spammer? Even if you have the list, there's not much you can do with it - these messages never reach the service, you cannot "whitelist" them or anything.
But you can always try to convince Microsoft, that's why we have UserVoice (or go directly to your TAM).
Hello Dima Razbornov,
I think it seems to be a bug. You can get that missing information easily by executing 'Get-MailDetailSpamReport' PowerShell cmdlet.
If you are not interested in playing with PowerShell then you can get the help from 3rd party tools. AdminDroid is one such tool which can help you with your requirement. You can find the demo of spam report and the mail traffic dashboard.
Admin droid are cool, but they don't provide more information than original Office 365 reports. I've tried them before asking my question.
Get-MailDetailSpamReport provides the same Event type, so there is no magic there if you look on it by yourself.
Event Type : SpamContentFiltered
