Filtering results of 'List emailThreatSubmissions' API call

Marc Paderes 0 Reputation points
2025-04-25T05:52:51.06+00:00

Hello!

How can I filter the below result of 'List emailThreatSubmissions' API call by sender, category or result.category?

https://graph.microsoft.com/beta/security/threatSubmission/emailThreats?$filter=category eq 'phishing' - This one is not working

{

    "id": "2231c48d-07af-4afa-f29f-08dd80ba5379",

    "clientSource": "microsoft",

    "createdDateTime": "2025-04-21T09:53:10.9251743Z",

    "contentType": "email",

    "status": "succeeded",

    "tenantId": "5874644c-3b15-4888-b10a-7a7a4c85b1fe",

    "category": "phishing",

    "source": "user",

    "recipientEmailAddress": "<REDACTED>",

    "internetMessageId": null,

    "subject": "Important: Your access is expiring soon.",

    "sender": "******@turst.corn",

    "senderIP": null,

    "receivedDateTime": "2025-04-02T06:02:40.1114255Z",

    "originalCategory": "notJunk",

    "adminReview": null,

    "tenantAllowOrBlockListAction": null,

    "createdBy": {

      "id": null,

      "displayName": null,

      "email": "<REDACTED>"

    },

    "result": {

      "category": "phishingSimulation",

      "detail": "partOfEducationCampaign",

      "policyType": null,

      "policyId": null,

      "userMailboxSetting": "none",

      "detectedUrls": [],

      "detectedFiles": []

    },

    "attackSimulationInfo": {

      "attackSimId": "cb144b09-71b5-4842-9fd5-a919d5ffeddc",

      "attackSimDateTime": "2025-04-02T06:00:53Z",

      "attackSimDurationTime": "P2D",

      "attackSimUserId": "a96891df-0c15-4bc0-a5aa-65b524195402"

    }

  }
Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
13,598 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.