Report: Explorer (Threat Explorer); View on the Email entity page: Timeline

Microsoft Defender for Office 365 provides Threat Explorer for investigating malicious and suspicious email messages. The Email entity page supplies detailed information about individual messages, including their delivery and post-delivery events.

First selection: Explorer (Threat Explorer).

Threat Explorer enables security analysts to search for email messages using properties such as subject, sender, recipient, detection technology, and delivery status.

The analyst can open Threat Explorer in the Microsoft Defender portal, select the relevant email view, and filter messages by the subject provided in the phishing report. Matching messages can then be examined individually.

Second selection: Timeline.

After identifying the suspicious message, the administrator can open its Email entity page and select the Timeline view.

The Timeline view displays the chronological history of message delivery and subsequent actions. It includes original delivery events, changes caused by Zero-hour Auto Purge (ZAP), quarantine actions, and other recorded message events.

This information enables the administrator to determine where the message was originally delivered and what actions occurred afterward.

Threat Explorer is therefore the correct investigation tool for locating messages by subject, while the Timeline view provides the required delivery and post-delivery history.

Microsoft References:

https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about

https://learn.microsoft.com/en-us/defender-office-365/mdo-email-entity-page