Whether other instances of the email were delivered or blocked.Where the email was sent from (sending infrastructure).A determination about what type of threat it might be.In addition, the user-reported message now triggers a system-based informational alert, which automatically launches the investigation playbook.ĭuring the root investigation phase, various aspects of the email are assessed. The submission is also sent to your system and is visible in Explorer in the Submissions view (formerly referred to as the User-reported view). The user, trained to report such messages, uses the Report Message add-in or the Report Phishing add-in to send it to Microsoft for analysis. Suppose that a user in your organization receives an email that they think is a phishing attempt. Example 3: A security operations team integrates AIR with their SIEM using the Office 365 Management Activity APIĮxample: A user-reported phish message launches an investigation playbook.Example 2: A security administrator triggers an investigation from Threat Explorer.Example 1: A user-reported phish message launches an investigation playbook.When you're ready to get started using AIR, see Automatically investigate and respond to threats. This article describes how AIR works through several examples. Appropriate remediation actions await approval, enabling your security operations team to respond to detected threats. AIR capabilities include automated investigation processes in response to well-known threats that exist today. Automated investigation and response (AIR) capabilities in Microsoft Defender for Office 365 can help.ĪIR enables your security operations team to operate more efficiently and effectively.
Sometimes, security operations teams can feel overwhelmed by the volume of alerts that are triggered. Microsoft Defender for Office 365 plan 2Īs security alerts are triggered, it's up to your security operations team to look into those alerts and take steps to protect your organization.This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 Defender portal. The improved Microsoft 365 Defender portal is now available.
0 kommentar(er)
