Threat protection

29 live and 5 declared entity sets in the Threat protection category. Live entity sets answer requests today; declared ones are in the catalogue with their backing cmdlets and roles and return 501 Not Implemented until they ship.

Live entity sets

Entity set	Label	Routes	Read role	Write role
antiPhishPolicies	Anti-Phishing Policies	5	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
antiPhishRules	Anti-Phishing Rules	7	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
atpBuiltInProtectionRule	Built-in Protection Rule	3	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
atpPolicyForO365	Defender Global Settings	2	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
configAnalyzerPolicyRecommendations	Policy Recommendations	2	ThreatPolicy.Read.All	read-only
hostedConnectionFilterPolicies	Connection Filter Policy	3	MailFlow.Read.All	MailFlow.ReadWrite.All
hostedContentFilterPolicies	Anti-Spam Policies	5	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
hostedContentFilterRules	Anti-Spam Rules	7	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
hostedOutboundSpamFilterPolicies	Outbound Spam Policies	5	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
hostedOutboundSpamFilterRules	Outbound Spam Rules	7	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
malwareFilterPolicies	Malware Filter Policies	5	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
malwareFilterRules	Malware Filter Rules	7	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
phishSimOverridePolicy	Phishing Simulation Policy	5	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
phishSimOverrideRules	Phishing Simulation Rules	5	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
protectionAlerts	Activity Alerts	5	Compliance.IPPS.Read.All	Compliance.IPPS.ReadWrite.All
quarantineMessages	Quarantined Messages	8	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
quarantinePolicies	Quarantine Policies	5	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
reportSubmissionPolicies	User Reporting Policies	5	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
reportSubmissionRules	User Reporting Rules	7	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
safeAttachmentPolicies	Safe Attachments Policies	5	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
safeAttachmentRules	Safe Attachments Rules	7	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
safeLinksPolicies	Safe Links Policies	5	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
safeLinksRules	Safe Links Rules	7	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
secOpsOverridePolicy	Security Team Override Policy	5	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
secOpsOverrideRules	Security Team Override Rules	5	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
teamsProtectionPolicy	Teams Protection Policies	3	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
teamsProtectionPolicyRules	Teams Protection Rules	4	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
tenantAllowBlockListItems	Tenant Allow/Block Lists	4	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All
tenantAllowBlockListSpoofItems	Spoofing Allow/Block Entries	4	ThreatPolicy.Read.All	ThreatPolicy.ReadWrite.All

Declared, not yet implemented

Entity set	Label	Backing cmdlets	Note
atpProtectionPolicyRules	Preset Policy Bindings	Get-ATPProtectionPolicyRule, Set-ATPProtectionPolicyRule, New-ATPProtectionPolicyRule, Remove-ATPProtectionPolicyRule	Standard/Strict preset policy rules
blockedSenderAddresses	Blocked Senders	Get-BlockedSenderAddress	Tenant-blocked sender addresses
eopProtectionPolicyRules	EOP Preset Policy Rules	Get-EOPProtectionPolicyRule, Set-EOPProtectionPolicyRule, New-EOPProtectionPolicyRule, Remove-EOPProtectionPolicyRule	EOP preset policy rules
quarantineMessageHeaders	Quarantine Message Headers	Get-QuarantineMessageHeader	Quarantined-message header inspection - accessed via /quarantineMessages/{key}/headers (slice 18)
spoofIntelligenceInsights	Spoof Intelligence Insights	Get-SpoofIntelligenceInsight	Tenant spoof-intelligence learning state