Forum Discussion

Copper Contributor

Jun 30, 2026

Defender of XDR - Quarantine - Lack of filter/search options

Hi Microsoft, I love what you're doing with the Defender XDR portal, but could you please show some love to the Quarantine section soon? On a daily basis, I have to review emails caught in quaranti...

investigation

microsoft defender for office 365

Threat Analytics

DerekMorgan2

Brass Contributor

Jul 13, 2026

Hi DarkingDK,

Jamony's workaround is the right direction. To make it concrete: EmailEvents has a SenderFromDomain column, which gets you the exact "ends with .dk" filter the quarantine search box can't do.

EmailEvents
| where Timestamp > ago(7d)
| where LatestDeliveryLocation == "Quarantine"
| where SenderFromDomain endswith ".dk"
| project Timestamp, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject,
          ThreatTypes, ConfidenceLevel, DeliveryLocation, LatestDeliveryLocation, NetworkMessageId
| order by Timestamp desc

Swap .dk for whatever domain you need. Use LatestDeliveryLocation rather than DeliveryLocation - it reflects current state, so anything already released won't show up as a false hit.

For attachment name or URL domain filtering, join EmailAttachmentInfo or EmailUrlInfo on NetworkMessageId - they carry FileName and UrlDomain respectively.

One more piece worth knowing: quarantine release now works straight from Advanced Hunting results. Select the rows this returns, Take actions > Move to Inbox, no separate trip to the quarantine portal. Turns your daily review into one query and one bulk action.

And yes, second the feedback submission - native domain filtering in Quarantine search is a reasonable ask, this shouldn't need a KQL workaround at all.

DerekMorgan2

Brass Contributor

Jul 13, 2026

Here are the other KQL queries for reference:

Attachment name filtering:

EmailEvents
| where Timestamp > ago(7d)
| where LatestDeliveryLocation == "Quarantine"
| join kind=inner (
    EmailAttachmentInfo
    | where FileName has "invoice"
) on NetworkMessageId
| project Timestamp, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject,
          FileName, FileType, ThreatTypes

URL domain filtering:

EmailEvents
| where Timestamp > ago(7d)
| where LatestDeliveryLocation == "Quarantine"
| join kind=inner (
    EmailUrlInfo
    | where UrlDomain has "suspicious-domain.com"
) on NetworkMessageId
| project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, Url, UrlDomain

DarkingDK
Copper Contributor
Jul 15, 2026
Thank you.

my main point was also that if you have a user interface for something like quarantine management, at least implement it better.

Its nice that the advanced hunting now lets you release etc. but it shouldn't be necessary to write kql to work with quarantine emails