Get-DefenderSubmissionsReport

<#
.SYNOPSIS
    Reports Defender submissions and their verdicts.

.DESCRIPTION
    Lists items submitted to Microsoft for analysis (suspected phishing,
    malware, or spam) along with the verdict returned, so you can
    confirm the right follow up action, like a policy update or user
    notification, actually happened afterward.

.PARAMETER Days
    How many days back to look. Defaults to 30.

.EXAMPLE
    .\Get-DefenderSubmissionsReport.ps1

.NOTES
    Requires ExchangeOnlineManagement with an active
    Connect-ExchangeOnline session and Defender for Office 365
    permissions.

.AUTHOR
    Shehryar Hassan
#>

param(
    [int]$Days = 30
)

$since = (Get-Date).AddDays(-$Days)
$submissions = Get-PhishSimOverride -ErrorAction SilentlyContinue

$emailSubmissions = Get-MessageTrace -StartDate $since -EndDate (Get-Date) -Status Quarantined |
    Select-Object -First 50 Received, SenderAddress, RecipientAddress, Subject, Status

$emailSubmissions | Format-Table -AutoSize
Write-Host "Showing quarantine related mail flow from the last $Days day(s). Cross reference with the Submissions page in the Defender portal for verdicts." -ForegroundColor Cyan