Goodmorning guys much help needed. I have been receiving a lot of phishing attempts to recipients emails. I am looking for the best query that can allow me to see if these emails were filtered as spam or quarantined.  Thanks I have been using query but it doesn't give me if the sender's email is filtered as spam or quarantined Sometimes it does not even work. sourcetype=0365:management:activity"sender.email@xx.com" AND "recepient.email@hhs.gov"| table sourcetype_time P2Sender recipients{} subject| sort Recepients{}| dedup Recipients {}    ... View more