You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-office-365/air-about.md
+19-12Lines changed: 19 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ ms.author: chrisda
7
7
manager: deniseb
8
8
audience: ITPro
9
9
ms.topic: conceptual
10
-
ms.date: 10/22/2024
10
+
ms.date: 01/10/2025
11
11
ms.localizationpriority: medium
12
12
search.appverid:
13
13
- MET150
@@ -31,7 +31,9 @@ appliesto:
31
31
32
32
As [security alerts](/defender-xdr/investigate-alerts) appear in a Microsoft 365 organization at <https://security.microsoft.com/alerts>, it's up to the security operations (SecOps) team to review, prioritize, and respond to those alerts. Keeping up with the volume of incoming alerts can be overwhelming. Automating some of those tasks can help.
33
33
34
-
[Microsoft Defender for Office 365 Plan 2](mdo-about.md#defender-for-office-365-plan-2-capabilities) includes powerful automated investigation and response (AIR) capabilities that save time and effort for SecOps teams. AIR includes the following capabilities:
34
+
[Microsoft Defender for Office 365 Plan 2](mdo-about.md#defender-for-office-365-plan-2-capabilities) (included in Microsoft 365 licenses like E5 or as a standalone subscription) includes powerful automated investigation and response (AIR) capabilities that save time and effort for SecOps teams.
35
+
36
+
AIR triages high impact, high volume alerts by completing organization level investigations. AIR investigations expand on detections or provide additional analysis to determine the threat status for the organization. When AIR identifies threats, it queues threat remediation actions for SecOps personnel to approve. AIR results in the following benefits:
35
37
36
38
- Automated investigation processes in response to well-known threats.
37
39
- Appropriate remediation actions awaiting approval, enabling your SecOps team to respond effectively to detected threats.
@@ -44,25 +46,32 @@ AIR in Defender for Office 365 Plan 2 requires that [audit logging is turned on]
44
46
An alert is triggered, and a security playbook starts an automated investigation, which results in findings and recommended actions. Here's the overall flow of AIR, step by step:
45
47
46
48
1. An automated investigation is started initiated in one of the following ways:
47
-
- An alert is triggered by an alert policy that identified something suspicious in email (for example, the message itself, an attachment, a URL, or a compromised user account). An incident is created, and an automated investigation begins.
49
+
- Specific alerts that are designed to initiate AIR. These alerts include:
50
+
- Something suspicious is identified in email (for example, the message itself, an attachment, a URL, or a compromised user account).
51
+
-[Zero-hour auto purge (ZAP)](zero-hour-auto-purge.md).
52
+
- User submissions.
53
+
- User click alerts.
54
+
- Suspicious mailbox behavior.
48
55
49
-
> [!TIP]
50
-
> Be sure to regularly review the alerts your organization. For more information about alert policies that trigger automated investigations, see the [default alert policies in the Threat management category](/purview/alert-policies#default-alert-policies). The entries that contain the value **Yes** for **Automated investigation** can trigger automated investigations. If these alerts are disabled or replaced by custom alerts, AIR isn't triggered.
56
+
> [!TIP]
57
+
> Be sure to regularly review the alerts your organization. For more information about alert policies that trigger automated investigations, see the [default alert policies in the Threat management category](/purview/alert-policies#threat-management-alert-policies). The entries that contain the value **Yes** for **Automated investigation** can trigger automated investigations. If these alerts are disabled or replaced by custom alerts, AIR isn't triggered.
51
58
52
-
- A security analyst manually triggers the investigation. For examples, see [Automated investigation and response (AIR) examples in Microsoft Defender for Office 365 Plan 2](air-examples.md).
59
+
- A security analyst manually triggers the investigation by selecting :::image type="icon" source="media/m365-cc-sc-take-actions-icon.png" border="false"::: **Take action** in Threat Explorer, Advanced hunting, custom detection, the Email entity page, or the Email summary panel. For more information, see [Threat hunting: Email remediation](threat-explorer-threat-hunting.md#email-remediation). For examples, see For examples, see [Automated investigation and response (AIR) examples in Microsoft Defender for Office 365 Plan 2](air-examples.md).
53
60
54
-
2.A running automated investigation gathers data about the specified email message and the related _entities_ (for example, attached files, included URLs, and recipients). The scope of the investigation can increase as new and related alerts are triggered.
61
+
2.The automated investigation evaluates and analyzes the nature of the alert, the message involved, and additional evidence surrounding the message. The scope of the investigation can increase based on the evidence that's uncovered and collected during the investigation.
55
62
56
63
3. During and after an automated investigation, [details and results](air-view-investigation-results.md) are available. Results might include [recommended actions](air-remediation-actions.md) for SecOps personnel to remediate the threats that were found.
57
64
58
-
4. The SecOps team reviews the [investigation results and recommendations](air-view-investigation-results.md), and [approves or rejects the remediation actions](air-review-approve-pending-completed-actions.md).
65
+
4. The SecOps team reviews the [investigation results and recommendations](air-view-investigation-results.md) (in the investigation itself, the incident, or in the Action center), and [approves or rejects the remediation actions](air-review-approve-pending-completed-actions.md).
59
66
60
67
> [!TIP]
61
68
> No remediation actions happen automatically. Remediation actions require manual approval by SecOps personnel. AIR capabilities save time by getting to the recommended remediation actions with all the details to make an informed decision.
69
+
>
70
+
> AIR also saves time by evaluating and automatically resolving alerts and incidents where no threats were found. This result is very common in user submission scenarios. AIR closes the investigation if no threats were found or threats were found in messages that have already been remediated. Typically
62
71
63
72
5. As pending remediation actions are approved or rejected, the automated investigation completes.
64
73
65
-
The automated investigation automatically closes if no recommended actions are identified. The details of the investigation are still available on the **Investigations** page at <>.
74
+
The automated investigation automatically closes if no recommended actions are identified. The details of the investigation are still available on the **Investigations** page at <https://security.microsoft.com/airinvestigation>.
66
75
67
76
During and after each automated investigation, the SecOps team can do the following tasks:
68
77
@@ -75,7 +84,7 @@ During and after each automated investigation, the SecOps team can do the follow
75
84
You need to be assigned permissions to use AIR. You have the following options:
76
85
77
86
-[Microsoft Defender XDR Unified role based access control (RBAC)](/defender-xdr/manage-rbac) (If **Email & collaboration**\>**Defender for Office 365** permissions is :::image type="icon" source="media/scc-toggle-on.png" border="false"::: **Active**. Affects the Defender portal only, not PowerShell):
78
-
-_Start an automated investigation_ or _Approve or reject recommended actions_: **Security Operator/Email advanced remediation actions (manage)**.
87
+
-_Start an automated investigation_ or _Approve or reject recommended actions_: **Security operations/Email advanced remediation actions (manage)**.
79
88
-[Email & collaboration permissions in the Microsoft Defender portal](mdo-portal-permissions.md):
80
89
-_Set up AIR features_: Membership in the **Organization Management** or **Security Administrator** role groups.
81
90
-_Start an automated investigation_ or _Approve or reject recommended actions_:
@@ -91,8 +100,6 @@ You need to be assigned permissions to use AIR. You have the following options:
91
100
92
101
To use AIR, you need to be assigned a license for Defender for Office 365 Plan 2 (included in your subscription or an add-on license).
93
102
94
-
AIR contains data for users with Defender for Office 365 licenses assigned to them.
It's up to your security operations (SecOps) team to investigate security alerts and take steps to protect your organization. SecOps teams can often feel overwhelmed by the volume of alerts that require review. Automated investigation and response (AIR) in Microsoft Defender for Office 365 Plan 2 can help. For more information about AIR, see [Automated investigation and response (AIR) in Microsoft Defender for Office 365 Plan 2](air-about.md).
33
-
34
-
AIR enables your SecOps team to operate more efficiently and effectively. AIR includes automated investigations to well-known threats, and provides recommended remediation actions. The SecOps team can review the evidence and approve or reject the recommended actions.
32
+
Automated investigation and response (AIR) in Microsoft Defender for Office 365 Plan 2 (included in Microsoft 365 licenses like E5 or as a standalone subscription) enables your SecOps team to operate more efficiently and effectively. AIR includes automated investigations to well-known threats, and provides recommended remediation actions. The SecOps team can review the evidence and approve or reject the recommended actions. For more information about AIR, see [Automated investigation and response (AIR) in Microsoft Defender for Office 365 Plan 2](air-about.md).
35
33
36
34
This article describes how AIR works through several examples:
37
35
@@ -41,35 +39,24 @@ This article describes how AIR works through several examples:
41
39
42
40
## Example: A user-reported phishing message launches an investigation playbook
43
41
44
-
A user receives an email that looks like a phishing attempt. The user reports the message using the [Microsoft Report Message or Report Phishing add-ins](submissions-users-report-message-add-in-configure.md), which results in the following actions:
45
-
46
-
- The submission is added to the **User reported** tab of the **Submissions** page in the Microsoft Defender portal at <https://security.microsoft.com/reportsubmission?viewid=user>.
47
-
- Depending on the [user reported settings](submissions-user-reported-messages-custom-mailbox.md), the message is sent to Microsoft for analysis directly by the user submission or by an admin from the **User reported** page.
48
-
- An alert is triggered by the **Email reported by user as malware or phish**[alert policy](/purview/alert-policies#threat-management-alert-policies), which automatically launches the investigation playbook.
42
+
A user receives an email that looks like a phishing attempt. The user reports the message using the [Microsoft Report Message or Report Phishing add-ins](submissions-users-report-message-add-in-configure.md), which results in an alert that's triggered by the **Email reported by user as malware or phish**[alert policy](/purview/alert-policies#threat-management-alert-policies), which automatically launches the investigation playbook.
49
43
50
-
During the root investigation phase, various aspects of the reported email message are assessed. For example:
44
+
Various aspects of the reported email message are assessed. For example:
51
45
52
-
- The identified threat type.
53
-
- Who sent the message.
54
-
- Where the message was sent from (sending infrastructure).
55
-
- Whether other instances of the message were delivered or blocked.
56
-
-An assessment from our analysts.
57
-
- Whether the message is associated with any known campaigns.
46
+
- The identified threat type
47
+
- Who sent the message
48
+
- Where the message was sent from (sending infrastructure)
49
+
- Whether other instances of the message were delivered or blocked
50
+
-The tenant landscape, including similar messages and their verdicts through email clustering
51
+
- Whether the message is associated with any known campaigns
58
52
- And more.
59
53
60
-
After the root investigation is complete, the playbook provides a list of recommended actions to take on the original message and the associated _entities_ (for example, attached files, included URLs, and recipients).
61
-
62
-
Next, several threat investigation and hunting steps are done:
54
+
The playbook evaluates and automatically resolves submissions where no action is needed (which frequently happens on user reported messages). For the remaining submissions, a list of recommended actions to take on the original message and the associated _entities_ (for example, attached files, included URLs, and recipients) is provided:
63
55
64
56
- Identify similar email messages via email cluster searches.
65
-
- Share the signal with other platforms (for example, [Microsoft Defender for Endpoint](/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection)).
66
57
- Determine whether any users clicked through any malicious links in suspicious email messages.
67
-
- Determine whether other users reported similar messages in [Exchange Online Protection](eop-about.md) (EOP) and [Microsoft Defender for Office 365](mdo-about.md).
68
-
- Determine whether a user is compromised. This check uses signals across Office 365, [Microsoft Defender for Cloud Apps](/cloud-app-security), and [Microsoft Entra ID](/azure/active-directory), correlating any related user activity anomalies.
69
-
70
-
During the hunting phase, risks and threats are assigned to various hunting steps. For more information, see [Details and results of an automated investigation](air-view-investigation-results.md).
71
-
72
-
Remediation is the final phase of the playbook. During this phase, remediation steps are taken, based on the investigation and hunting phases. For more information, see [Remediation actions in Microsoft Defender for Office 365](air-remediation-actions.md).
58
+
- Risks and threats are assigned. For more information, see [Details and results of an automated investigation](air-view-investigation-results.md).
59
+
- Remediation steps. For more information, see [Remediation actions in Microsoft Defender for Office 365](air-remediation-actions.md).
73
60
74
61
## Example: A security administrator triggers an investigation from Threat Explorer
In Microsoft 365 organizations with [Microsoft Defender for Office 365 Plan 2](mdo-about.md#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet), automated investigation and response (AIR) often results in pending remediation actions. For example:
29
+
In Microsoft 365 organizations with [Microsoft Defender for Office 365 Plan 2](mdo-about.md#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet) (included in Microsoft 365 licenses like E5 or as a standalone subscription), automated investigation and response (AIR) often results in pending remediation actions. For example:
30
30
31
31
- Soft deleting email messages or clusters.
32
32
- Turning off external mail forwarding.
@@ -47,9 +47,9 @@ These remediation actions aren't taken automatically. The remediation actions ne
47
47
48
48
For more information about the **Incidents** page in Defender for Office 365, see [Details and results of automated investigation and response (AIR) in Microsoft Defender for Office 365 Plan 2](air-view-investigation-results.md).
49
49
50
-
1. In the Microsoft Defender portal at <https://security.microsoft.com>, go to the Email & collaboration **Investigations** page at **Email & collaboration**\>**Investigations**. Or, to go directly to the Email & collaboration **Investigations** page, use <https://security.microsoft.com/airinvestigation>.
51
-
2. On the **Investigations** page, find and an item in the list where the **Status** value is **Pending approval**. Use :::image type="icon" source="media/m365-cc-sc-filter-icon.png" border="false"::: **Filter** to filter the results by the **Status** value **Pending action**.
52
-
3. On the **Investigations** page, select the **Pending action** item by clicking on :::image type="icon" source="media/m365-cc-sc-open-icon.png" border="false"::: **Open in new window** in the **ID**column (don't select the check box).
50
+
1. In the Microsoft Defender portal at <https://security.microsoft.com>, go to the **Investigations** page in Defender for Office 365 at **Email & collaboration**\>**Investigations**. Or, to go directly to the **Investigations** page in Defender for Office 365, use <https://security.microsoft.com/airinvestigation>.
51
+
2. On the **Investigations** page in Defender for Office 365, find and an item in the list where the **Status** value is **Pending approval**. Use :::image type="icon" source="media/m365-cc-sc-filter-icon.png" border="false"::: **Filter** to filter the results by the **Status** value **Pending action**.
52
+
3. On the **Investigations** page, select the **Pending action** item by clicking on :::image type="icon" source="media/m365-cc-sc-open-icon.png" border="false"::: **Open in new window** in the **ID**column (don't select the check box).
53
53
4. In the investigation details page that opens, select the **Pending actions** tab, and then select an entry from the list by clicking anywhere in the row other than the check box next to the first column.
54
54
5. In the details flyout that opens, review the information and then select one of the following actions from the top of the flyout:
55
55
- :::image type="icon" source="media/m365-cc-sc-check-mark-icon.png" border="false"::: **Approve**: Initiate the pending action.
@@ -59,8 +59,8 @@ For more information about the **Incidents** page in Defender for Office 365, se
59
59
60
60
For more information about the **Incidents** page in Defender XDR, see [Investigate incidents in Microsoft Defender XDR](/defender-xdr/investigate-incidents).
61
61
62
-
1. In the Microsoft Defender portal at <https://security.microsoft.com>, go to the Defender XDR **Incidents** page at **Incidents & alerts**\>**Incidents**. Or, to go directly to the Defender XDR **Incidents** page, use <https://security.microsoft.com/incidents>.
63
-
2. On the **Investigations** page, find and an item in the list where the **Status** value is **Pending approval**. Use the following steps to filter the results:
62
+
1. In the Microsoft Defender portal at <https://security.microsoft.com>, go to the **Incidents** page in Defender XDR at **Incidents & alerts**\>**Incidents**. Or, to go directly to the **Incidents** page in Defender XDR, use <https://security.microsoft.com/incidents>.
63
+
2. On the **Investigations** page in Defender XDR, find and an item in the list where the **Status** value is **Pending approval**. Use the following steps to filter the results:
64
64
1. Clear any existing unwanted filters on the **Incidents** page by selecting :::image type="icon" source="media/m365-cc-sc-remove-selection-icon.png" border="false"::: **Clear**.
0 commit comments