You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-for-cloud-apps/data-protection-policies.md
+5-2Lines changed: 5 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -44,6 +44,11 @@ The following are examples of file policies that can be created:
44
44
45
45
***Sensitive file extension** - Receive an alert about files with specific extensions that are highly exposed. Select the specific extension (for example, crt for certificates) or filename and exclude those files with private sharing level.
46
46
47
+
## Prerequisites
48
+
49
+
To set up the first File Policy in a tenant, you need Microsoft Entra **Service Principal** permissions. **Service Principal** permissions are only automatically given if no file policy exists yet. After the first file policy is created, you can create more without needing those permissions.
50
+
51
+
47
52
## Create a new file policy
48
53
49
54
To create a new file policy, follow this procedure:
@@ -98,8 +103,6 @@ To create a new file policy, follow this procedure:
98
103
99
104
:::image type="content" source="media/file-policy-edit-and-preview-results.png" alt-text="Screenshot that shows how you can see a preview of the filtered results for file policies.":::
100
105
101
-
102
-
103
106
1. To view file policy matches, files that are suspected to violate the policy, go to **Policies** -> **Policy management**. Filter the results to display only the file policies using the **Type** filter at the top. For more information about the matches for each policy, under the **Count** column, select the number of **matches** for a policy. Alternatively, select the three dots at the end of the row for a policy and choose **View all matches**. This opens the **File policy report**. Select the **Matching now** tab to see files that currently match the policy. Select the **History** tab to see a history back to up to six months of files that matched the policy.
Copy file name to clipboardExpand all lines: defender-office-365/mdo-email-entity-page.md
+9-3Lines changed: 9 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ f1.keywords:
5
5
author: chrisda
6
6
ms.author: chrisda
7
7
manager: bagol
8
-
ms.date: 07/07/2025
8
+
ms.date: 09/22/2025
9
9
audience: ITPro
10
10
ms.topic: article
11
11
ms.service: defender-office-365
@@ -297,7 +297,10 @@ Use :::image type="icon" source="media/m365-cc-sc-download-icon.png" border="fal
297
297
298
298
If you select an entry in the **Attachments** view by clicking on the **Attachment filename** value, a details flyout opens that contains the following information:
299
299
300
-
-**Deep analysis** tab: Information is available on this tab if [Safe Attachments](safe-attachments-about.md) scanned (detonated) the attachment. You can identify these messages in Threat Explorer by using the query filter **Detection technology** with the value **File detonation**.
300
+
-**Deep analysis** tab: Information is available on this tab if [Safe Attachments](safe-attachments-about.md) scanned (detonated) the attachment and it is identified as malicious through detonation. You can identify these messages in Threat Explorer using the following methods:
301
+
-**Detection technology** query filter with the value **File detonation**.
302
+
-**Detonation available** indicator in the **Details** column.
303
+
- The detonation count shown in the Email Summary Panel.
301
304
302
305
-**Detonation chain** section: Safe Attachments detonation of a single file can trigger multiple detonations. The _detonation chain_ tracks the path of detonations, including the original malicious file that caused the verdict, and all other files affected by the detonation. These attached files might not be directly present in the email. But, including the analysis is important to determining why the file was found to be malicious.
303
306
@@ -378,7 +381,10 @@ Use :::image type="icon" source="media/m365-cc-sc-download-icon.png" border="fal
378
381
379
382
If you select an entry in the **URL** view by clicking on the **URL** value, a details flyout opens that contains the following information:
380
383
381
-
-**Deep analysis** tab: Information is available on this tab if [Safe Links](safe-links-about.md) scanned (detonated) the URL. You can identify these messages in Threat Explorer by using the query filter **Detection technology** with the value **URL detonation**.
384
+
-**Deep analysis** tab: Information is available on this tab if [Safe Links](safe-links-about.md) scanned (detonated) the URL and it is identified as malicious through detonation. You can identify these messages in Threat Explorer using the following methods:
385
+
-**Detection technology** query filter with the value **URL detonation**.
386
+
-**Detonation available** indicator in the **Details** column.
387
+
- The detonation count shown in the Email Summary Panel.
382
388
383
389
-**Detonation chain** section: Safe Links detonation of a single URL can trigger multiple detonations. The _detonation chain_ tracks the path of detonations, including the original malicious URL that caused the verdict, and all other URLs affected by the detonation. These URLs might not be directly present in the email. But, including the analysis is important to determining why the URL was found to be malicious.
> To allow phishing URLs that are part of non-Microsoft attack simulation training, use the [advanced delivery configuration](advanced-delivery-policy-configure.md) to specify the URLs. Don't use the Tenant Allow/Block List.
32
-
33
30
You might occasionally disagree with the Microsoft filtering verdict for email messages, Microsoft Teams messages, or Office apps. For example, a good message might be marked as bad (a false positive), or a bad message might be allowed through (a false negative), or a URL might be blocked when it shouldn't have.
34
31
35
32
The Tenant Allow/Block List in the Microsoft Defender portal gives you a way to manually override filtering verdicts. The list is used during mail flow (for email) or time of click (for email, Teams, or Office apps).
36
33
37
-
Entries for **Domains and email addresses** and **Spoofed senders** apply to messages from both internal and external senders. Special handling applies to internal spoofing scenarios. Block entries for **Domains and email addresses** also prevent users in the organization from *sending* email to those blocked domains and addresses.
38
-
39
34
The Tenant Allow/Block list is available in the Microsoft Defender portal at <https://security.microsoft.com>**Email & collaboration**\>**Policies & rules**\>**Threat Policies**\>**Rules** section \>**Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block Lists** page, use <https://security.microsoft.com/tenantAllowBlockList>.
40
35
41
36
For usage and configuration instructions, see the following articles:
42
37
43
38
-**Domains and email addresses** and **spoofed senders**: [Allow or block emails using the Tenant Allow/Block List](tenant-allow-block-list-email-spoof-configure.md)
39
+
- Entries apply to the MAIL FROM address (also known as the `5321.MailFrom` address, P1 sender, or envelope sender), not the From address (also known as the `5322.From` address or P2 sender). For more information about these addresses, see [Why internet email needs authentication](email-authentication-about.md#why-internet-email-needs-authentication).
40
+
- Entries apply to messages from both internal and external senders. Special handling applies to internal spoofing scenarios.
41
+
- Block entries for **Domains and email addresses** also prevent users in the organization from *sending* email to those blocked domains and addresses.
44
42
-**Files**: [Allow or block files using the Tenant Allow/Block List](tenant-allow-block-list-files-configure.md)
45
43
-**URLs**: [Allow or block URLs using the Tenant Allow/Block List](tenant-allow-block-list-urls-configure.md).
44
+
- To allow phishing URLs from non-Microsoft attack simulation training, don't use URL allow entries in the Tenant Allow/Block List. Use the [advanced delivery policy](advanced-delivery-policy-configure.md) to specify the URLs.
46
45
-**IP addresses**: [Allow or block IPv6 addresses using the Tenant Allow/Block List](tenant-allow-block-list-ip-addresses-configure.md).
47
46
-**Teams domains**: [Block domains in Microsoft Teams using the Tenant Allow/Block List](tenant-allow-block-list-teams-domains-configure.md).
Copy file name to clipboardExpand all lines: exposure-management/Qualys-data-connector.md
+11-3Lines changed: 11 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -48,8 +48,6 @@ To establish a connection with Qualys in Exposure Management, follow these steps
48
48
49
49
Qualys connector retrieves data on compute devices, including machines and virtual machines, and vulnerability findings from Qualys on those assets. It also retrieves some networking data to identify those devices.
50
50
51
-
Only devices that were modified in the last 90 days are retrieved, based on assessing the "modified" field in the Qualys asset.
Copy file name to clipboardExpand all lines: exposure-management/Rapid7-data-connector.md
+11-3Lines changed: 11 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,8 +31,6 @@ To establish a connection with Rapid7 in Exposure Management, follow these steps
31
31
32
32
Exposure Management retrieves data on compute devices from Rapid7, including machines and virtual machines. It also retrieves vulnerabilities reported by Rapid7 on those devices.
33
33
34
-
Only devices that were actively scanned in the last 90 days are retrieved, based on assessing the "last_scan_end" field in the Rapid7 asset.
|**Assets/devices, and data per each identifier**| - Rapid7 ID<br>- Hostname<br>- IP address<br>- mac Address<br>- OS information<br>- Rapid7 risk score<br>- Tags<br>- Rapid7 criticality data<br>- Cloud platform |
@@ -54,4 +52,14 @@ Here are some common issues that might arise when configuring the Rapid7 Connect
54
52
55
53
## Next steps
56
54
57
-
[Getting value from your data connectors](value-data-connectors.md).
55
+
After configuring the Rapid7 data connector:
56
+
57
+
-[Review your attack surface map](enterprise-exposure-map.md) to see Rapid7 data
Copy file name to clipboardExpand all lines: exposure-management/ServiceNow-data-connector.md
+11-3Lines changed: 11 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -40,8 +40,6 @@ To establish a connection with ServiceNow in Exposure Management, follow these s
40
40
41
41
Exposure Management currently retrieves data on devices, their business application association, and business criticality. Additional data is also retrieved that helps identify the device, such as network adapter information and OS data.
42
42
43
-
Only devices that were active in the last 90 days are retrieved, based on assessing the "sys_updated_on" field in the ServiceNow CI.
44
-
45
43
The following fields are ingested via the connector:
46
44
47
45
|**Category**|**Properties**|
@@ -69,4 +67,14 @@ Here are some common issues that might arise when configuring the ServiceNow Con
69
67
70
68
## Next steps
71
69
72
-
[Getting value from your data connectors](value-data-connectors.md).
70
+
After configuring the ServiceNow data connector:
71
+
72
+
-[Review your attack surface map](enterprise-exposure-map.md) to see ServiceNow data
Copy file name to clipboardExpand all lines: exposure-management/Tenable-data-connector.md
+11-3Lines changed: 11 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -44,8 +44,6 @@ To establish a connection with Tenable in Exposure Management, follow these step
44
44
45
45
Exposure Management retrieves data on compute devices from Tenable, including machines and virtual machines. It also retrieves some networking data to identify those devices.
46
46
47
-
Only devices that were modified in the last 90 days are retrieved, based on assessing the "updated_at" field in the Tenable asset.
48
-
49
47
Exposure Management also retrieves vulnerability findings from Tenable on those assets.
50
48
51
49
The vulnerability data retrieved for Tenable is applicable to CVEs only, and not other types of vulnerabilities or misconfigurations. Tenable shows total vulnerability counts that include other non-CVE misconfigurations as well, so these counts aren't applicable to the numbers of vulnerabilities ingested to Exposure Management.
@@ -77,4 +75,14 @@ Here are some common issues that might arise when configuring the Tenable Connec
77
75
78
76
## Next steps
79
77
80
-
[Getting value from your data connectors](value-data-connectors.md).
78
+
After configuring the Tenable data connector:
79
+
80
+
-[Review your attack surface map](enterprise-exposure-map.md) to see Tenable data
0 commit comments