What is emailThreatsId for emailThreatSubmission Review action in Microsoft Graph?

Liam Jones 126 Reputation points
2022-10-21T09:15:02.22+00:00

Hi all,

In the Microsoft Graph Beta docs, there is an option to classify emailThreats but to do this it requires a GUID Microsoft call emailThreatsId. I can't see any documentation on what this ID actually is or where it is found.

Ideally I would like to get this value through an alert in Sentinel if possible but just knowing what the ID is or where it is would help.

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
11,038 questions
0 comments No comments
{count} votes

Accepted answer
  1. Vasil Michev 98,196 Reputation points MVP
    2022-10-21T10:15:12.637+00:00

    That's just a placeholder, you can use any Id value as obtained from a GET /security/threatSubmission/emailThreats query. Similarly, once you have the (list of) Id, you can do a single GET request against a specific thread, where {} stands for the value you obtain from the Id property:

    GET /security/threatSubmission/emailThreats/{id goes here}  
    
    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful