---
title: M365 Quarantine and Hygiene Signal
description: Identifies Microsoft 365 email quarantine, hygiene, and mail submission events. These signals indicate blocked threats, spam filtering actions, and user-reported...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_microsoft_quarantine_hygiene_signal
products:
  - Elastic Security
---

# M365 Quarantine and Hygiene Signal
Identifies Microsoft 365 email quarantine, hygiene, and mail submission events. These signals indicate blocked threats,
spam filtering actions, and user-reported suspicious emails. While these represent blocked or mitigated threats, they
provide valuable telemetry for understanding attempted attacks and attack patterns. This building block rule generates
security events for correlation, threat hunting, and telemetry collection.
**Rule type**: query
**Rule indices**:
- logs-o365.audit-*
- filebeat-*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://learn.microsoft.com/en-us/defender-office-365/quarantine-about](https://learn.microsoft.com/en-us/defender-office-365/quarantine-about)](https://learn.microsoft.com/en-us/defender-office-365/quarantine-about)
- [[https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-protection-about](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-protection-about)](https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-protection-about)
- [[https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32](https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32)](https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32)

**Tags**:
- Domain: Cloud
- Domain: SaaS
- Data Source: Microsoft 365
- Data Source: Microsoft 365 Audit Logs
- Data Source: Microsoft Defender for Office 365
- Use Case: Threat Detection
- Use Case: Blocked Threat Tracking
- Tactic: Initial Access
- Rule Type: BBR
- Rule Type: Custom Query (KQL)
- Platform: Microsoft 365
- Domain: Email

**Version**: 3
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).

## Rule Query

```kuery
event.dataset:o365.audit and event.code:(Quarantine or HygieneEvent or MailSubmission)
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Initial Access
  - Id: TA0001
  - Reference URL: [[https://attack.mitre.org/tactics/TA0001/](https://attack.mitre.org/tactics/TA0001/)](https://attack.mitre.org/tactics/TA0001/)
- Technique:
  - Name: Phishing
  - Id: T1566
  - Reference URL: [[https://attack.mitre.org/techniques/T1566/](https://attack.mitre.org/techniques/T1566/)](https://attack.mitre.org/techniques/T1566/)
- Sub Technique:
  - Name: Spearphishing Attachment
  - Id: T1566.001
  - Reference URL: [[https://attack.mitre.org/techniques/T1566/001/](https://attack.mitre.org/techniques/T1566/001/)](https://attack.mitre.org/techniques/T1566/001/)
- Sub Technique:
  - Name: Spearphishing Link
  - Id: T1566.002
  - Reference URL: [[https://attack.mitre.org/techniques/T1566/002/](https://attack.mitre.org/techniques/T1566/002/)](https://attack.mitre.org/techniques/T1566/002/)