You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-office-365/address-compromised-users-quickly.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -47,7 +47,7 @@ When a user account is compromised, alerts are triggered. And in some cases, tha
47
47
-[View details about automated investigations](#view-details-about-automated-investigations)
48
48
49
49
> [!IMPORTANT]
50
-
> You must have appropriate permissions to perform the following tasks. For more information, see [Required permissions to use AIR capabilities](air-about.md#required-permissions-and-licensing-for-air).
50
+
> You must have appropriate permissions to perform the following tasks. See [Required permissions to use AIR capabilities](air-about.md#required-permissions-to-use-air-capabilities).
51
51
52
52
Watch this short video to learn how you can detect and respond to user compromise in Microsoft Defender for Office 365 using Automated Investigation and Response (AIR) and compromised user alerts.
53
53
@@ -81,7 +81,7 @@ To learn more, see [View details of an investigation](air-view-investigation-res
81
81
82
82
## Next steps
83
83
84
-
-[Review the required permissions to use AIR capabilities](air-about.md#required-permissions-and-licensing-for-air)
84
+
-[Review the required permissions to use AIR capabilities](air-about.md#required-permissions-to-use-air-capabilities)
85
85
86
86
-[Find and investigate malicious email in Office 365](threat-explorer-investigate-delivered-malicious-email.md)
Automated investigation and response (AIR) in Microsoft Defender for Office 365 Plan 2 returns detailed information about the results. For more information, see [Details and results of automated investigation and response (AIR) in Microsoft Defender for Office 365 Plan 2](air-view-investigation-results.md).
32
-
33
-
However, some Microsoft 365 organizations use custom or third-party reporting solutions. Those organizations can use the **Office 365 Management Activity APIs** to integrate information from AIR into other reporting solutions.
31
+
With [Microsoft Defender for Office 365](mdo-about.md), you get [detailed information about automated investigations](air-view-investigation-results.md). However, some organizations also use a custom or third-party reporting solution. If your organization wants to integrate information about [automated investigations](air-about.md) with such a solution, you can use the Office 365 Management Activity API.
It's up to your security operations (SecOps) team to investigate security alerts and take steps to protect your organization. SecOps teams can often feel overwhelmed by the volume of alerts that require review. Automated investigation and response (AIR) in Microsoft Defender for Office 365 Plan 2 can help. For more information about AIR, see [Automated investigation and response (AIR) in Microsoft Defender for Office 365 Plan 2](air-about.md).
32
+
As security alerts are triggered, it's up to your security operations team to look into those alerts and take steps to protect your organization. Sometimes, security operations teams can feel overwhelmed by the volume of alerts that are triggered. Automated investigation and response (AIR) capabilities in Microsoft Defender for Office 365 can help.
33
33
34
-
AIR enables your SecOps team to operate more efficiently and effectively. AIR includes automated investigations to well-known threats, and provides recommended remediation actions. The SecOps team can review the evidence and approve or reject the recommended actions.
34
+
AIR enables your security operations team to operate more efficiently and effectively. AIR capabilities include automated investigation processes in response to well-known threats that exist today. Appropriate remediation actions await approval, enabling your security operations team to respond to detected threats.
35
35
36
-
This article describes how AIR works through several examples:
36
+
This article describes how AIR works through several examples. When you're ready to get started using AIR, see [Automatically investigate and respond to threats](air-about.md).
37
37
38
-
-[Example: A user-reported phishing message launches an investigation playbook](#example-a-user-reported-phishing-message-launches-an-investigation-playbook)
39
-
-[Example: A security administrator triggers an investigation from Threat Explorer](#example-a-security-administrator-triggers-an-investigation-from-threat-explorer)
40
-
-[Example: A security operations team integrates AIR with their SIEM using the Office 365 Management Activity API](#example-a-security-operations-team-integrates-air-with-their-siem-using-the-office-365-management-activity-api)
38
+
-[Example 1: A user-reported phish message launches an investigation playbook](#example-a-user-reported-phish-message-launches-an-investigation-playbook)
39
+
-[Example 2: A security administrator triggers an investigation from Threat Explorer](#example-a-security-administrator-triggers-an-investigation-from-threat-explorer)
40
+
-[Example 3: A security operations team integrates AIR with their SIEM using the Office 365 Management Activity API](#example-a-security-operations-team-integrates-air-with-their-siem-using-the-office-365-management-activity-api)
41
41
42
-
## Example: A user-reported phishing message launches an investigation playbook
42
+
## Example: A user-reported phish message launches an investigation playbook
43
43
44
-
A user receives an email that looks like a phishing attempt. The user reports the message using the [Microsoft Report Message or Report Phishing add-ins](submissions-users-report-message-add-in-configure.md), which results in the following actions:
44
+
Suppose that a user in your organization receives an email that they think is a phishing attempt. The user, trained to report such messages, uses the [Microsoft Report Message or Report Phishing add-ins](submissions-users-report-message-add-in-configure.md) to send it to Microsoft for analysis. The submission is also sent to your system and is visible in Explorer in the **Submissions** view (formerly referred to as the **User-reported** view). In addition, the user-reported message now triggers a system-based informational alert, which automatically launches the investigation playbook.
45
45
46
-
- The submission is added to the **User reported** tab of the **Submissions** page in the Microsoft Defender portal at <https://security.microsoft.com/reportsubmission?viewid=user>.
47
-
- Depending on the [user reported settings](submissions-user-reported-messages-custom-mailbox.md), the message is sent to Microsoft for analysis directly by the user submission or by an admin from the **User reported** page.
48
-
- An alert is triggered by the **Email reported by user as malware or phish**[alert policy](/purview/alert-policies#threat-management-alert-policies), which automatically launches the investigation playbook.
46
+
During the root investigation phase, various aspects of the email are assessed. These aspects include:
49
47
50
-
During the root investigation phase, various aspects of the reported email message are assessed. For example:
48
+
- A determination about what type of threat it might be;
49
+
- Who sent it;
50
+
- Where the email was sent from (sending infrastructure);
51
+
- Whether other instances of the email were delivered or blocked;
52
+
- An assessment from our analysts;
53
+
- Whether the email is associated with any known campaigns;
54
+
- and more.
51
55
52
-
- The identified threat type.
53
-
- Who sent the message.
54
-
- Where the message was sent from (sending infrastructure).
55
-
- Whether other instances of the message were delivered or blocked.
56
-
- An assessment from our analysts.
57
-
- Whether the message is associated with any known campaigns.
58
-
- And more.
56
+
After the root investigation is complete, the playbook provides a list of recommended actions to take on the original email and the _entities_ associated with it (for example, files, URLs, and recipients).
59
57
60
-
After the root investigation is complete, the playbook provides a list of recommended actions to take on the original message and the associated _entities_ (for example, attached files, included URLs, and recipients).
58
+
Next, several threat investigation and hunting steps are executed:
61
59
62
-
Next, several threat investigation and hunting steps are done:
60
+
- Similar email messages are identified via email cluster searches.
61
+
- The signal is shared with other platforms, such as [Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection).
62
+
- A determination is made on whether any users have clicked through any malicious links in suspicious email messages.
63
+
- A check is done across [Exchange Online Protection](eop-about.md) (EOP) and [Microsoft Defender for Office 365](mdo-about.md) to see if there are any other similar messages reported by users.
64
+
- A check is done to see if a user has been compromised. This check leverages signals across Office 365, [Microsoft Defender for Cloud Apps](/cloud-app-security), and [Microsoft Entra ID](/azure/active-directory), correlating any related user activity anomalies.
63
65
64
-
- Identify similar email messages via email cluster searches.
65
-
- Share the signal with other platforms (for example, [Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection)).
66
-
- Determine whether any users clicked through any malicious links in suspicious email messages.
67
-
- Determine whether other users reported similar messages in [Exchange Online Protection](eop-about.md) (EOP) and [Microsoft Defender for Office 365](mdo-about.md).
68
-
- Determine whether a user is compromised. This check uses signals across Office 365, [Microsoft Defender for Cloud Apps](/cloud-app-security), and [Microsoft Entra ID](/azure/active-directory), correlating any related user activity anomalies.
66
+
During the hunting phase, risks and threats are assigned to various hunting steps.
69
67
70
-
During the hunting phase, risks and threats are assigned to various hunting steps. For more information, see [Details and results of an automated investigation](air-view-investigation-results.md).
71
-
72
-
Remediation is the final phase of the playbook. During this phase, remediation steps are taken, based on the investigation and hunting phases. For more information, see [Remediation actions in Microsoft Defender for Office 365](air-remediation-actions.md).
68
+
Remediation is the final phase of the playbook. During this phase, remediation steps are taken, based on the investigation and hunting phases.
73
69
74
70
## Example: A security administrator triggers an investigation from Threat Explorer
75
71
76
-
You're in Explorer (Threat Explorer) at <https://security.microsoft.com/threatexplorerv3> in the **All email**, **Malware**, or **Phish** views. You're on the **Email** tab (view) of the details area below the chart. You select a message to investigate by using either of the following methods:
77
-
78
-
- Select one or more entries in the table by selecting the check box next to the first column. :::image type="icon" source="media/m365-cc-sc-take-actions-icon.png" border="false"::: **Take action** is available directly in the tab.
79
-
80
-
:::image type="content" source="media/te-rtd-all-email-view-take-action.png" alt-text="Screenshot of the Email view (tab) of the details table with a message selected and Take action active." lightbox="media/te-rtd-all-email-view-take-action.png":::
72
+
In addition to automated investigations that are triggered by an alert, your organization's security operations team can trigger an automated investigation from a view in [Threat Explorer](threat-explorer-real-time-detections-about.md). This investigation also creates an alert, so Microsoft Defender XDR incidents and external SIEM tools can see that this investigation was triggered.
81
73
82
-
- Click on the **Subject**value of an entry in the table. The details flyout that opens contains :::image type="icon" source="media/m365-cc-sc-take-actions-icon.png" border="false"::: **Take action** at the top of the flyout.
74
+
For example, suppose that you are using the **Malware**view in Explorer. Using the tabs below the chart, you select the **Email** tab. If you select one or more items in the list, the **+ Actions** button activates.
83
75
84
-
:::image type="content" source="media/te-rtd-all-email-view-email-tab-details-area-subject-details-flyout-actions-only.png" alt-text="The actions available in the details tab after you select a Subject value in the Email tab of the details area in the All email view." lightbox="media/te-rtd-all-email-view-email-tab-details-area-subject-details-flyout-actions-only.png":::
76
+
:::image type="content" source="media/Explorer-Malware-Email-ActionsInvestigate.png" alt-text="The Explorer with selected messages" lightbox="media/Explorer-Malware-Email-ActionsInvestigate.png":::
85
77
86
-
After you select :::image type="icon" source="media/m365-cc-sc-take-actions-icon.png" border="false"::: **Take action**, select **Initiate automated investigation**. For more information, see [Email remediation](threat-explorer-threat-hunting.md#email-remediation).
78
+
Using the **Actions** menu, you can select **Trigger investigation**.
87
79
88
-
Similar to playbooks triggered by an alert, automatic investigations that are triggered from Threat Explorer include:
80
+
:::image type="content" source="media/explorer-malwareview-selectedemails-actions.jpg" alt-text="The Actions menu for selected messages" lightbox="media/explorer-malwareview-selectedemails-actions.jpg":::
89
81
90
-
- A root investigation.
91
-
- Steps to identify and correlate threats. For more information, see [Details and results of an automated investigation](air-view-investigation-results.md).
92
-
- Recommended actions to mitigate threats. For more information, see [Remediation actions in Microsoft Defender for Office 365](air-remediation-actions.md).
82
+
Similar to playbooks triggered by an alert, automatic investigations that are triggered from a view in Explorer include a root investigation, steps to identify and correlate threats, and recommended actions to mitigate those threats.
93
83
94
84
## Example: A security operations team integrates AIR with their SIEM using the Office 365 Management Activity API
95
85
96
-
AIR capabilities in Defender for Office 365 Plan 2 include [reports and details](air-view-investigation-results.md) that the SecOps team can use to monitor and address threats. But you can also integrate AIR capabilities with other solutions. For example:
97
-
98
-
- Security information and event management (SIEM) systems.
99
-
- Case management systems.
100
-
- Custom reporting solutions.
101
-
102
-
Use the [Office 365 Management Activity API](/office/office-365-management-api/office-365-management-activity-api-reference) for integration with these solutions.
103
-
104
-
For an example of a custom solution that integrates alerts from user-reported phishing messages that were already processed by AIR into a SIEM server and case management system, see [Tech Community blog: Improve the Effectiveness of your SOC with Microsoft Defender for Office 365 and the Office 365 Management API](https://techcommunity.microsoft.com/t5/microsoft-security-and/improve-the-effectiveness-of-your-soc-with-office-365-atp-and/ba-p/1525185).
86
+
AIR capabilities in Microsoft Defender for Office 365 include [reports & details](air-view-investigation-results.md) that security operations teams can use to monitor and address threats. But you can also integrate AIR capabilities with other solutions. Examples include a security information and event management (SIEM) system, a case management system, or a custom reporting solution. These kinds of integrations can be done by using the [Office 365 Management Activity API](/office/office-365-management-api/office-365-management-activity-api-reference).
105
87
106
-
The integrated solution greatly reduces the number of false positives, which allows the SecOps team to focus their time and effort on real threats.
88
+
For example, recently, an organization set up a way for their security operations team to view user-reported phish alerts that were already processed by AIR. Their solution integrates relevant alerts with the organization's SIEM server and their case-management system. The solution greatly reduces the number of false positives so that their security operations team can focus their time and effort on real threats. To learn more about this custom solution, see [Tech Community blog: Improve the Effectiveness of your SOC with Microsoft Defender for Office 365 and the O365 Management API](https://techcommunity.microsoft.com/t5/microsoft-security-and/improve-the-effectiveness-of-your-soc-with-office-365-atp-and/ba-p/1525185).
0 commit comments