Defender of XDR - Quarantine - Lack of filter/search options

Hi Microsoft, I love what you're doing with the Defender XDR portal, but could you please show some love to the Quarantine section soon? On a daily basis, I have to review emails caught in quaranti...

investigation

microsoft defender for office 365

Threat Analytics

DerekMorgan2

Brass Contributor

Jul 13, 2026

Here are the other KQL queries for reference:

Attachment name filtering:

EmailEvents
| where Timestamp > ago(7d)
| where LatestDeliveryLocation == "Quarantine"
| join kind=inner (
    EmailAttachmentInfo
    | where FileName has "invoice"
) on NetworkMessageId
| project Timestamp, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject,
          FileName, FileType, ThreatTypes

URL domain filtering:

EmailEvents
| where Timestamp > ago(7d)
| where LatestDeliveryLocation == "Quarantine"
| join kind=inner (
    EmailUrlInfo
    | where UrlDomain has "suspicious-domain.com"
) on NetworkMessageId
| project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, Url, UrlDomain

DarkingDK

Copper Contributor

Jul 15, 2026

Thank you.

my main point was also that if you have a user interface for something like quarantine management, at least implement it better.

Its nice that the advanced hunting now lets you release etc. but it shouldn't be necessary to write kql to work with quarantine emails

Forum Discussion

Defender of XDR - Quarantine - Lack of filter/search options