Forum Discussion
Dec 20, 2023
Use KQL or advanced hunting to show the list of quarantine email with release status: Release reques
Hi team, I am looking for a solution to list the quarantine email with release status: Release requested. Either with advanced hunting or Ms Sentinel. I am able to extract the list of the whole...
Danfew
Mar 18, 2024Copper Contributor
Hi Nidhal
I too am looking for that data and i just came across the release action in Advanced Hunting in MDE.
EmailEvents
| where LatestDeliveryAction contains "Quarantine release"