Forum Discussion
Defender of XDR - Quarantine - Lack of filter/search options
Hi Microsoft,
I love what you're doing with the Defender XDR portal, but could you please show some love to the Quarantine section soon?
On a daily basis, I have to review emails caught in quarantine for false positives, and the lack of search and filtering options is appalling.
As a company based in Denmark, 99% of legitimate emails come from .dk domains. Yet there is no way to search for or filter on something this simple.
If I type .dk into the search box, I get 0 results, even though I can clearly see .dk sender addresses on the page. The filter options only allow me to enter full sender or recipient email addresses, which is of course almost useless in a quarantine-review context.
Some examples of filters that would be extremely useful:
- Sender domain ends with .dk
- Sender domain contains .dk
- URL domain filtering
- Attachment name filtering
- Saved filter views
- More flexible search across message properties
The Quarantine experience could be made dramatically better with relatively little effort.
So please, pretty please, give the Quarantine portal some attention. It's often the part of Defender that security teams interact with every single day.
4 Replies
Hi DarkingDK,
Jamony's workaround is the right direction. To make it concrete: EmailEvents has a SenderFromDomain column, which gets you the exact "ends with .dk" filter the quarantine search box can't do.
EmailEvents | where Timestamp > ago(7d) | where LatestDeliveryLocation == "Quarantine" | where SenderFromDomain endswith ".dk" | project Timestamp, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject, ThreatTypes, ConfidenceLevel, DeliveryLocation, LatestDeliveryLocation, NetworkMessageId | order by Timestamp descSwap .dk for whatever domain you need. Use LatestDeliveryLocation rather than DeliveryLocation - it reflects current state, so anything already released won't show up as a false hit.
For attachment name or URL domain filtering, join EmailAttachmentInfo or EmailUrlInfo on NetworkMessageId - they carry FileName and UrlDomain respectively.
One more piece worth knowing: quarantine release now works straight from Advanced Hunting results. Select the rows this returns, Take actions > Move to Inbox, no separate trip to the quarantine portal. Turns your daily review into one query and one bulk action.
And yes, second the feedback submission - native domain filtering in Quarantine search is a reasonable ask, this shouldn't need a KQL workaround at all.
Here are the other KQL queries for reference:
Attachment name filtering:EmailEvents | where Timestamp > ago(7d) | where LatestDeliveryLocation == "Quarantine" | join kind=inner ( EmailAttachmentInfo | where FileName has "invoice" ) on NetworkMessageId | project Timestamp, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject, FileName, FileType, ThreatTypesURL domain filtering:
EmailEvents | where Timestamp > ago(7d) | where LatestDeliveryLocation == "Quarantine" | join kind=inner ( EmailUrlInfo | where UrlDomain has "suspicious-domain.com" ) on NetworkMessageId | project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, Url, UrlDomainThank you.
my main point was also that if you have a user interface for something like quarantine management, at least implement it better.
Its nice that the advanced hunting now lets you release etc. but it shouldn't be necessary to write kql to work with quarantine emails
Hi, I agree this is a real pain point, especially when quarantine review is a daily operational task. As a workaround, I’d use Explorer or Advanced Hunting where available to narrow down message sender, recipient, domain, subject, and delivery details before taking action in quarantine. It is not as smooth as having proper quarantine filters, but it can reduce the amount of manual checking. I’d also submit this through the Defender portal feedback option, because filtering by sender domain and recipient domain would be a very reasonable feature request for security teams.
