How to submit email sample to Microsoft for analysis via API, PowerShell or other way

Question

How to submit email sample to Microsoft for analysis via API, PowerShell or other way

Sławomir Janiszewski 20

Hello,

Is there any other way to submit a email sample to Microsoft other than through the portal? It would be appropriate via Graph API, PowerShell, sending email with sample in attachment to the appropriate address or some other way.

There is a "Email threat submission" API but it seems it's not possible to send a sample to Microsoft, please correct me if I'm wrong.

https://learn.microsoft.com/en-us/graph/api/security-emailthreatsubmission-post-emailthreats?view=graph-rest-beta&tabs=http

To clarify, this functionality shown in the screenshot is needed. We want to send samples to Microsoft via app so reporting via the portal or via the phishing button is not a solution.

We do not need feedback on the result of the analysis by Microsoft, this reporting is intended to improve the filtering of unwanted emails (phishing).

User's image

Antkiewicz Maciej 6 Reputation points

2024-08-23T12:50:21.73+00:00

Hi,

Did you find a solution to achieve this goal using API, PowerShell?

Accepted answer

1 additional answer

Your answer

Antkiewicz Maciej 6 Reputation points

2024-08-23T12:50:21.73+00:00

Hi,

Did you find a solution to achieve this goal using API, PowerShell?

Answer 1

TH-4749-MSFT 3,315

Hello

You can also try the method via the threatAssessmentrequests endpoint as documented in article https://learn.microsoft.com/en-us/graph/api/informationprotection-post-threatassessmentrequests?view=graph-rest-1.0&tabs=http.

Thanks.

TH-4749-MSFT 3,315 Reputation points

2023-07-05T14:28:04.8133333+00:00

Hello Sławomir Janiszewski,

Good day. Hope all is well.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Thanks.
TH-4749-MSFT 3,315 Reputation points

2023-07-06T13:58:22.8766667+00:00

Hello Sławomir Janiszewski,

Good day. Hope all is well.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Thanks.
Sławomir Janiszewski 20 Reputation points

2023-07-10T15:53:52.01+00:00

From what I can see in the documentation, that's what I'm looking for. However, there is an error when we try to do it via API although we can create it in the portal without any problems. Even the global admin has the same error.

Same error both when we try to create or list requests.
TH-4749-MSFT 3,315 Reputation points

2023-07-11T18:07:19.6366667+00:00

Hi Sławomir Janiszewski,

Thanks for your email. I was able to reproduce the issue via Graph Explorer and Postman using delegate permissions. The problem appears to be with the ThreatAssessment.ReadWrite.All delegate permissions. I would suggest opening a support ticket for the issue. I was however able to use the Postman application via App flow authentication and ThreatAssessment.Read.All application permission to get a successful response. Please see screenshot below:

Please try the above and let us know if this worked for you or not.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Thanks.

Answer 2

TH-4749-MSFT 3,315

Hello Sławomir Janiszewski,

Thanks for reaching out. Email Submission via Graph API is currently in preview. Please refer to below article for more information on the topic.

https://learn.microsoft.com/en-us/graph/api/resources/security-emailthreatsubmission?view=graph-rest-beta

Please note that APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Thanks.

Sławomir Janiszewski 20

Thanks for the answer, do you mean request like this?

POST https://graph.microsoft.com/beta/security/threatSubmission/emailThreats
Content-type: application/json

{
  "@odata.type": "#microsoft.graph.security.emailContentThreatSubmission",
  "category": "spam",
  "recipientEmailAddress": "******@a830edad9050849EQTPWBJZXODQ.onmicrosoft.com",
  "fileContent": "UmVjZWl2ZWQ6IGZyb20gTVcyUFIwME1CMDMxNC5uYW1wcmQwMC....." 
}


source:

I used it. Unfortunately, such a sample has not been submitted to Microsoft.
Can it be sent to Microsoft using API/PowerShell?

User's image

TH-4749-MSFT 3,315 Reputation points

2023-07-04T19:50:05.4466667+00:00

Hello Sławomir Janiszewski,

Thanks for your reply. Did you receive an error when posting the query or did it return a response with the submission object in the body of the response as documented in the article I sent in the previous email?

Thanks.
Sławomir Janiszewski 20 Reputation points

2023-07-10T15:41:33.6566667+00:00

There wasn't any error. From what I understand everything worked fine - it created entry in "User reported" tab. This is a User submission and not an admin submission so it hasn't been reported to Microsoft. I would probably have to change the global settings so that every user report is reported to Microsoft, and I don't want that

Share via

How to submit email sample to Microsoft for analysis via API, PowerShell or other way

1 additional answer

Your answer