Data Protection Issues

How to Add Sender and Subject to Quarantined Message Release Alerts

John Wilson Oct 7, 2026 868 views

Question details

The user needs to configure Microsoft Defender XDR and Microsoft Sentinel alerts to display the original sender and subject for quarantined message release requests.

How to Add Sender and Subject to Quarantined Message Release Alerts

Product: Microsoft Defender XDR and Sentinel
Device & OS: not provided
Scenario: Configuring incident alerts for quarantined email release requests to provide better context to security administrators.
Observed behavior: Default alerts only display the incident title and recipient, omitting the original sender and subject details.

Before you start

Ensure you have the appropriate administrative permissions in Microsoft Defender XDR and Microsoft Sentinel to query underlying event data and modify automation playbooks or analytics rules.

Solution 1Recommended

Review Event Data and Create a Custom Alert Notification

Use advanced hunting and analytics rules to map the hidden sender and subject fields into your custom Microsoft Sentinel incident alerts.

The default alert schema may omit certain fields to prevent alert fatigue. However, the data is often still captured in the underlying telemetry. By querying the raw quarantine event data, you can build custom alerts that include the exact fields you need.

Inspect the raw event schema

Log in to the Microsoft Defender or Microsoft Sentinel portal and navigate to the Logs or Advanced Hunting section. Run a Kusto Query Language (KQL) query on your email events to verify if the sender and subject fields are captured in the underlying quarantine event data.

Update the analytics rule

If the fields are available in the raw logs, go to Microsoft Sentinel Analytics. Edit the rule generating your quarantine release alerts and update the entity mapping to explicitly include the sender and subject fields.

Modify the automation playbook

Alternatively, if you use an automation playbook (Logic Apps) to send email or Teams notifications for these incidents, update the dynamic content in your playbook to extract and display the newly mapped sender and subject fields.

Seek further support if fields are missing

If your advanced hunting query reveals that these fields are completely missing from the schema for this specific event type, escalate the issue by posting in Microsoft Q&A using the Microsoft Sentinel and security tags.

Review Event Data and Create a Custom Alert Notification

Schema Limitations: The ability to include specific fields entirely depends on the available alert schema provided by Microsoft. If Microsoft does not log the sender or subject for a specific trigger, it cannot be dynamically added to the alert.

Free Microsoft Office alternative

Looking for a Secure and Free Office Alternative?

Managing enterprise security alerts in Microsoft Defender requires specialized tools, but handling your daily documents doesn't have to be complicated or expensive. WPS Office is a powerful, lightweight, and free alternative to Microsoft Office that easily handles all your document needs.

1. Download the installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install WPS Office: Run the downloaded installer and follow the on-screen prompts to complete the setup in minutes.
3. Open your Microsoft files securely: Launch WPS Office and directly open your existing Microsoft Office files with perfect formatting compatibility and built-in security features.

Fully compatible with Microsoft Word, Excel, and PowerPoint file formats (.docx, .xlsx, .pptx).Built-in document encryption and password protection to keep your sensitive local files secure.Lightweight design that installs quickly and runs smoothly on Windows, Mac, and Linux.Familiar user interface ensuring a seamless migration with zero learning curve.

microsoft office alternative - wps office

Frequently Asked Questions

Why are the sender and subject fields missing from default quarantine alerts?

By default, Microsoft Sentinel and Defender XDR prioritize high-level details like the incident title and recipient to minimize alert fatigue. Niche fields like original sender or subject are sometimes omitted from the default incident view but may still exist in the backend logs.

Can I use Advanced Hunting to expose these hidden fields?

Yes. If the data is logged in the underlying Microsoft Defender telemetry, you can use Kusto Query Language (KQL) in Advanced Hunting to extract the sender and subject, and then use that query to power a custom analytics rule.

What if the event data does not contain sender and subject details at all?

If the underlying schema does not expose these fields natively for the specific quarantine release event, you cannot extract them. You will need to submit a feature request to Microsoft Security Support or consult the Microsoft Q&A community for potential API-based workarounds.

Microsoft Office Security Issues