Overwatch

Every status above pairs a colour with a word and a shape, because this table gets screenshotted into tickets and read by people who do not see the colour. The severity column is the API's own judgement; the four protocol columns describe what is published, and the recommended records in each row are what to publish instead.

This ledger lists only the blocks requested through this console. Entries created by hand in the Microsoft Defender portal — both of these customers already have some — are not shown here, are not counted here, and are not reversed by anything on this page. An empty table means nothing was blocked from here, not that nothing is blocked.

A rule matches messages and flags them: it contributes a score and writes a row to the match log. Rules do not move, junk, quarantine or delete mail, and there is no setting here that makes them. Remediating a message is a separate action a person takes on one named message at a time.

Disabling is one click and takes effect on the next message analysed. Enabling is not: every route to switching a rule on goes through a preview against this customer's own history first, because the only way to find out that an obvious-looking rule sweeps up a hundred legitimate purchase orders is to run it over the mail that already arrived.

Every row here is a message a rule matched and flagged. Nothing in this list was moved, junked, quarantined or deleted by a rule — a flag contributes to a message's score and writes the row you are reading. Where a rule has been edited since it matched, the row shows the rule as it stood at the time, because a renamed or rewritten rule otherwise makes its own history unreadable.