Hi all, In the Microsoft Graph Beta docs , there is an option to classify emailThreats but to do this it requires a GUID Microsoft call emailThreatsId . I can't see any documentation on what this ID actually is or where it is found. Ideally I would like to get this value through an alert in Sentinel if possible but just knowing what the ID is or where it is would help.

That's just a placeholder, you can use any Id value as obtained from a GET /security/threatSubmission/emailThreats query. Similarly, once you have the (list of) Id, you can do a single GET request against a specific thread, where {} stands for the value you obtain from the Id property: GET /security/threatSubmission/emailThreats/{id goes here}

What is emailThreatsId for emailThreatSubmission Review action in Microsoft Graph?

Accepted answer

Vasil Michev 95,081 Reputation points MVP

2022-10-21T10:15:12.637+00:00
That's just a placeholder, you can use any Id value as obtained from a GET /security/threatSubmission/emailThreats query. Similarly, once you have the (list of) Id, you can do a single GET request against a specific thread, where {} stands for the value you obtain from the Id property:

GET /security/threatSubmission/emailThreats/{id goes here}
Please sign in to rate this answer.

1 person found this answer helpful.
Liam Jones 126 Reputation points

2022-10-21T10:18:13.197+00:00

Thanks for taking the time to reply Michev.

I know it's a placeholder, where in my Microsoft 365 Defender do i find the ID for a submission? I am presuming it is somewhere in the submissions tab but I have tried a number of different IDs and the request fails with 400 error

Vasil Michev 95,081 Reputation points MVP

2022-10-21T10:46:40.977+00:00

Works fine here. Here are some examples from Graph Explorer:

GET https://graph.microsoft.com/beta/security/threatSubmission/emailThreats

then using the Id from above to POST against /review:

Works fine with the SubmissionId as reported from the UI, but do make sure to filter based on the type of submission (i.e. $filter=source eq 'administrator'). And check your permissions, the examples above are with ThreatSubmission.ReadWrite.All

Liam Jones 126 Reputation points

2022-10-24T09:51:14.203+00:00

Ohh I see, so I need to make a GET request using the Message ID in order to get the threat submission Id. Thank you for you help

Liam Jones 126 Reputation points

2022-10-26T20:08:22.787+00:00

Please could you try using the Get request with a filter? I keep getting 400 error message invalid filter clause I think it's a bug. Here is what I have tried:

https://graph.microsoft.com/beta/security/threatSubmission/emailThreats?$filter=startswith(emailSubject,'EXTER')

https://graph.microsoft.com/beta/security/threatSubmission/emailThreats?$filter=emailSubject eq 'EXTER'
Sign in to comment

What is emailThreatsId for emailThreatSubmission Review action in Microsoft Graph?

0 additional answers