Skip to content

Explorer

Explorer is a powerful tool for reviewing incoming and outgoing email within your environment. It contains up to 30 days of email which you can easily report to Microsoft and delete if necessary.

This page contains a few tabs to get to different sets of data easier:

  • All email
  • Malware
  • Phish
  • Campaigns
  • Content Malware
  • URL clicks

On these pages you can change the timespan you are viewing, setup search criteria, change the graph pivot, and save your queries for future use. Depending on the page you will be able to select an entity such as an email entity. These will quickly provide useful information about any detected threats and allow you to quickly take actions on emails without having to run a message trace or complicated PowerShell cmdlet.

Filters

Below I have provided all the filters and their selectable options where applicable. I have often wished the filter list was searchable or have forgotten which filter I needed to get to a specific piece of criteria which is why I have documented all of them below for a quick webpage search.

Filters
Order Filter Category Frequently Used Type
1 Sender address Basic Yes String
2 Recipients Basic String
3 Sender domain Basic String
4 Recipient domain Basic String
5 Subject Basic String
6 Sender display name Basic String
7 Sender mail from address Basic String
8 Sender mail from domain Basic String
9 Return path Basic String
10 Return path domain Basic String
11 Tags Basic String
12 Impersonated domain Basic String
13 Exchange transport rule Basic String
14 Data loss prevention rule Basic String
15 Context Basic Multi-select
16 Connector Basic String
17 Delivery action Basic Multi-select
18 Additional action Basic Yes Multi-select
19 Directionality Basic Yes Multi-select
20 Detection technology Basic Yes Multi-select
21 Original delivery location Basic Yes Multi-select
22 Latest delivery location Basic Yes Multi-select
23 Phish confidence level Basic Multi-select
24 Primary override Basic Yes Single-select
25 Primary override source Basic Yes Single-select
26 Override source Basic Yes Single-select
27 Policy type Basic Yes Multi-select
28 Policy action Basic Yes Multi-select
29 Threat type Basic Multi-select
30 Forwarded message Basic Boolean
31 Distribution list Basic String
32 Email size Basic String/Int
33 Internet Message ID Advanced String
34 Network Message ID Advanced String
35 Sender IP Advanced String
36 Attachment SHA256 Advanced String
37 Cluster ID Advanced String
38 Alert ID Advanced String
39 Alert Policy ID Advanced String
40 Campaign ID Advanced String
41 ZAP URL signal Advanced String
42 URL Count Urls String
43 URL domain Urls String
44 URL domain and path Urls String
45 URL Urls String
46 URL path Urls String
47 URL source Urls Multi-select
48 Click verdict Urls Multi-select
49 URL Threat Urls Multi-select
50 Attachment Count File String
51 Attachment filename File String
52 File type File String
53 File Extension File String
54 File Size File String
55 SPF Authentication Yes Multi-select
56 DKIM Authentication Yes Multi-select
57 DMARC Authentication Yes Multi-select
58 Composite Authentication Yes Multi-select

Multi-select and single-select filters

Filter options
Context
Delivery action
  • Blocked
  • Delivered
  • Delivered to junk
  • Replaced
Additional action
Directionality
  • Inbound
  • Intra-org
  • Outbound
Detection technology
  • Advanced filter
  • Antimalware protection
  • Bulk
  • Campaign
  • Domain reputation
  • File detonation
  • File detonation reputation
  • File reputation
  • Fingerprint matching
  • General filter
  • Impersonation brand
  • Impersonation domain
  • Impersonation user
  • IP reputation
  • Mailbox intelligence impersonation
  • Mixed analysis detection
  • Spoof DMARC
  • Spoof external domain
  • Spoof intra-org
  • URL detonation
  • URL detonation reputation
  • URL malicious reputation
Original delivery location
  • Deleted items folder
  • Dropped
  • Failed
  • Inbox/folder
  • Junk folder
  • On-prem/external
  • Quarantine
  • Unknown
Latest delivery location
  • Deleted items folder
  • Dropped
  • Failed
  • Inbox/folder
  • Junk folder
  • On-prem/external
  • Quarantine
  • Unknown
Phish confidence level
  • High
  • Normal
Primary override
  • Allowed by organization policy
  • Allowed by user policy
  • Blocked by organization policy
  • Blocked by user policy
  • None
Primary override source
  • 3rd Party Filter
  • Admin initiated time travel
  • Antimalware policy block by file type
  • Antispam policy settings
  • Connection policy
  • Exchange transport rule
  • Exclusive mode (User override)
  • Filtering skipped due to on-prem organization
  • IP region filter from policy
  • Language filter from policy
  • Phishing Simulation
  • Quarantine release
  • SecOps Mailbox
  • Sender address list (Admin Override)
  • Sender address list (User override)
  • Sender domain list (Admin Override)
  • Sender domain list (User override)
  • Tenant Allow/Block List file block
  • Tenant Allow/Block List sender email address block
  • Tenant Allow/Block List spoof block
  • Tenant Allow/Block List URL block
  • Trusted contact list (User override)
  • Trusted domain (User override)
  • Trusted recipient (User override)
  • Trusted senders only (User override)
Override source
  • 3rd Party Filter
  • Admin initiated time travel
  • Antimalware policy block by file type
  • Antispam policy settings
  • Connection policy
  • Exchange transport rule
  • Exclusive mode (User override)
  • Filtering skipped due to on-prem organization
  • IP region filter from policy
  • Language filter from policy
  • Phishing Simulation
  • Quarantine release
  • SecOps Mailbox
  • Sender address list (Admin Override)
  • Sender address list (User override)
  • Sender domain list (Admin Override)
  • Sender domain list (User override)
  • Trusted contact list (User override)
  • Trusted domain (User override)
  • Trusted recipient (User override)
  • Trusted senders only (User override)
Policy type
Policy action
  • Add x-header
  • Bcc message
  • Delete message
  • Modify subject
  • Move to junk mail folder
  • No action taken
  • Redirect message
  • Send to quarantine
Threat type
  • Malware
  • Phish
  • Spam
URL source
  • Attachments
  • Cloud attachment
  • Email body
  • Email header
  • QR Code
  • Subject
  • Unknown
Click verdict
  • Allowed
  • Block overridden
  • Blocked
  • Error
  • Failure
  • None
  • Pending verdict
  • Pending verdict bypassed
URL Threat
  • Malware
  • Phish
  • Spam
SPF
  • Fail
  • Neutral
  • None
  • Pass
  • Permanent error
  • Soft fail
  • Temporary error
DKIM
  • Error
  • Fail
  • Ignore
  • None
  • Pass
  • Test
  • Timeout
  • Unknown
DMARC
  • Best guess pass
  • Fail
  • None
  • Pass
  • Permanent error
  • Selector pass
  • Temporary error
  • Unknown
Composite
  • Fail
  • None
  • Pass
  • Soft Pass

Tip

If you build a particularly useful query you can save it and access it over on the Threat tracker page. You can also schedule your saved query to run on a regular basis.