Creating custom alert policies in Office365

Question

Hi

I am trying to create a new alert policy using the New-ProtectionAlert cmdlet with the following Filter parameters

1. Mail.IsThreat is $true
2. Message header 'my-policy-result: fail' exists in an email

My questions are:

1. How/where is the Mail.IsThreat filterable property defined? Is it only settable by EOP or Defender365?
2. Can you define a Filter parameter based on a message header?

Thanks

Answer 1

@Jason Atkins

This Tag is mainly dedicated to question related with Exchange online, since your question is related with Office 365, I would suggest you open a service request to confirm with Office 365 team.

Here are my suggestions, it may be useful to you:

The "Mail:IsThreat" is belonged to "Malware", if you want to using it, you need to have this add-on subscription below:

If you are not familiar with PowerShell, you can create this policy in security and compliance center, then use command below to check it:

Get-ProtectionAlert -Identity "YourPolicy" | fl filter   

About whether this alter could filter on message header, you can also confirm with the Office 365 team.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi thanks for the reply

I will raise the ticket as you suggest. I have a developer E5 license at the moment but will look to see if I can add either of those add-ons to get a bit further.

Out of interest, what did you enter to get the information about ThreatType: Malware?

Thanks