Where did the Phish delivered due to ETR override default alert go?

Question

Hello

Please i need your help on this issue.

I noticed that the Phish delivered due to ETR override default alert go inside Microsoft defender?

How can i create a default Phis delivered due to ETR Override

Answer 1

It looks like you're interested in understanding how to create a default alert for "Phish delivered due to ETR override" in Microsoft Defender. Here's a brief overview of the process:

1. Understanding ETR Override: Exchange Transport Rules (ETR) are used to apply specific actions to messages as they pass through the transport pipeline. An ETR override can allow a phishing email to be delivered despite other security measures
2. Creating the Alert:

• Navigate to Microsoft Defender: Go to the Microsoft 365 Defender portal.
• Create a New Alert Policy: Under the "Alerts" section, create a new alert policy.
  • Define Conditions: Set the conditions to trigger an alert when a phishing email is delivered due to an ETR override. You can specify the criteria based on the message properties and the actions taken by the ETR.
  Review and Save: After defining the conditions, review the settings and save the alert policy. This will ensure that you receive notifications whenever a phishing email is delivered due to an ETR override