This document provides details on the filters supported by each provider for each API operation. Filters can be used to restrict the results of an API operation, such as filtering by a specific field or value. If a provider or operation does not support filters, it will not be listed here.
They are used in conjunction with the filter query parameter in the API request.
Microsoft 365 Management Activity filters for query_email_events
Field
Operators
Supported Values
metadata.logged_time
gte, lte
datetime
Microsoft Defender filters for query_email_events
Field
Operators
Supported Values
direction
eq, in
Inbound, Outbound, Internal
time
gte, lte
datetime
Microsoft Exchange Online filters for query_email_events
Field
Operators
Supported Values
email.from
eq, like
string
email.to
eq, like
string
time
gte, lte
datetime
[MOCK] Microsoft Defender for Office 365 filters for query_email_events
Field
Operators
Supported Values
direction
eq, in
Inbound, Outbound, Internal
time
gte, lte
datetime
Ironscales filters for query_threats
Field
Operators
Supported Values
time
gte, lte
datetime
Microsoft Defender filters for query_threats
Field
Operators
Supported Values
disposition
eq, in
Unknown, Allowed, Blocked, Quarantined, No Action, Rejected
time
gte, lte
datetime
Mimecast Cloud Gateway filters for query_threats
Field
Operators
Supported Values
disposition
eq, in
Unknown, Allowed, Blocked, Quarantined, No Action, Rejected
time
gte, lte
datetime
[MOCK] Microsoft Defender for Office 365 filters for query_threats
Field
Operators
Supported Values
disposition
eq, in
Unknown, Allowed, Blocked, Quarantined, No Action, Rejected
time
gte, lte
datetime
[MOCK] Mimecast Cloud Gateway filters for query_threats
Field
Operators
Supported Values
disposition
eq, in
Unknown, Allowed, Blocked, Quarantined, No Action, Rejected