Skip to main content

purview threatassessment get

Get a threat assessment

Usage​

m365 purview threatassessment get [options]

Options​

-i, --id <id>

The Id of the threat assessment.

--includeResults

Include the threat assessment results.

-h, --help [help]

Output usage information. Optionally, specify which section of command's help you want to see. Allowed values are options, examples, remarks, response, full. Default is options.

--query [query]

JMESPath query string. See http://jmespath.org/ for more information and examples.

-o, --output [output]

Output type. json, text, csv, md, none. Default json.

--verbose

Runs command with verbose logging.

--debug

Runs command with debug logging.

Examples​

Get a threat assessment.

m365 purview threatassessment get --id c37d695e-d581-4ae9-82a0-9364eba4291e

Get a threat assessment including results.

m365 purview threatassessment get --id c37d695e-d581-4ae9-82a0-9364eba4291e --includeResults

Response​

Standard Response​

{
  "id": "8aaba0ac-ec4d-4e62-5774-08db16c68731",
  "createdDateTime": "2023-02-25T00:23:33.0550644Z",
  "contentType": "mail",
  "expectedAssessment": "block",
  "category": "spam",
  "status": "pending",
  "requestSource": "administrator",
  "recipientEmail": "john@contoso.com",
  "destinationRoutingReason": "notJunk",
  "messageUri": "https://graph.microsoft.com/v1.0/users/john@contoso.com/messages/AAMkADgzN2Q1NThiLTI0NjYtNGIxYS05MDdjLTg1OWQxNzgwZGM2ZgBGAAAAAAC6jQfUzacTSIHqMw2yacnUBwBiOC8xvYmdT6G2E_hLMK5kAAAAAAEMAABiOC8xvYmdT6G2E_hLMK5kAALHNaMuAAA=",
  "createdBy": {
    "user": {
      "id": "fe36f75e-c103-410b-a18a-2bf6df06ac3a",
      "displayName": "John Doe"
    }
  }
}

includeResults response​

When we make use of the option includeResults the response will differ.

{
  "id": "8aaba0ac-ec4d-4e62-5774-08db16c68731",
  "createdDateTime": "2023-02-25T00:23:33.0550644Z",
  "contentType": "mail",
  "expectedAssessment": "block",
  "category": "spam",
  "status": "pending",
  "requestSource": "administrator",
  "recipientEmail": "john@contoso.com",
  "destinationRoutingReason": "notJunk",
  "messageUri": "https://graph.microsoft.com/v1.0/users/john@contoso.com/messages/AAMkADgzN2Q1NThiLTI0NjYtNGIxYS05MDdjLTg1OWQxNzgwZGM2ZgBGAAAAAAC6jQfUzacTSIHqMw2yacnUBwBiOC8xvYmdT6G2E_hLMK5kAAAAAAEMAABiOC8xvYmdT6G2E_hLMK5kAALHNaMuAAA=",
  "createdBy": {
    "user": {
      "id": "fe36f75e-c103-410b-a18a-2bf6df06ac3a",
      "displayName": "John Doe"
    }
  },
  "results": [
    {
      "id": "a5455871-18d1-44d8-0866-08db16c68b85",
      "createdDateTime": "2023-02-25T00:23:40.28Z",
      "resultType": "checkPolicy",
      "message": "No policy was hit."
    }
  ]
}
CTRL + M