Elastic Security Detection Rules

M365 Quarantine and Hygiene Signal

Last updated 12 days ago on 2026-02-20
Created 12 days ago on 2026-02-20

About

Identifies Microsoft 365 email quarantine, hygiene, and mail submission events. These signals indicate blocked threats, spam filtering actions, and user-reported suspicious emails. While these represent blocked or mitigated threats, they provide valuable telemetry for understanding attempted attacks and attack patterns. This building block rule generates security events for correlation, threat hunting, and telemetry collection.
Tags
Domain: CloudDomain: SaaSData Source: Microsoft 365Data Source: Microsoft 365 Audit LogsData Source: Microsoft Defender for Office 365Use Case: Threat DetectionUse Case: Blocked Threat TrackingTactic: Initial AccessRule Type: BBRLanguage: kuery
Severity
low
Risk Score
21
MITRE ATT&CK™

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Phishing (T1566)(external, opens in a new tab or window)

License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-o365.audit-*filebeat-*
Related Integrations

o365(external, opens in a new tab or window)

Query
text code block:
event.dataset:o365.audit and event.code:(Quarantine or HygieneEvent or MailSubmission)

Install detection rules in Elastic Security

Detect M365 Quarantine and Hygiene Signal in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).