You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-office-365/apivendorecosystem.md
+17-17Lines changed: 17 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -63,7 +63,7 @@ Must be licensed with one of the following third-party solutions:
63
63
64
64
## Understanding the Integration
65
65
66
-
The integration works by allowing the thirdparty to pass in details on a specific message regarding the verdict, confidence level, and any threat details they would like to share via a private Microsoft Graph API. Microsoft Defender for Office 365 will then acknowledge the verdict provided and determine what the highest verdict on a message was. MDO will update the message and/or logs with the verdict information, moving the message to the user policy-specified location. You'll then be able to see the results of this integration in multiple unified experiences, including Reporting, Advanced Hunting, Email Entity, Quarantine, and Threat Explorer.
66
+
The integration works by allowing the third-party to pass in details on a specific message regarding the verdict, confidence level, and any threat details they would like to share via a private Microsoft Graph API. Microsoft Defender for Office 365 will then acknowledge the verdict provided and determine what the highest verdict on a message was. MDO will update the message and/or logs with the verdict information, moving the message to the user policy-specified location. You'll then be able to see the results of this integration in multiple unified experiences, including Reporting, Advanced Hunting, Email Entity, Quarantine, and Threat Explorer.
67
67
68
68
## Configuring your Policies
69
69
@@ -104,15 +104,15 @@ The [Email Entity](/defender-office-365/mdo-email-entity-page) page consolidates
104
104
105
105
Security teams can use Microsoft 365 Defender’s [Advanced Hunting](/defender-xdr/advanced-hunting-overview) capabilities to query and correlate data across native and third-party detections. Vendor-submitted messages are represented in the [EmailEvents](/defender-xdr/advanced-hunting-emailevents-table) and [EmailPostDeliveryEvents](/defender-xdr/advanced-hunting-emailpostdeliveryevents-table) tables, with extended schema support for partner-specific attributes, including vendor-specific threat details.
106
106
107
-
Use this example query to see 3rd party catch in Advanced Hunting.
107
+
Use this example query to see third-party catch in Advanced Hunting.
@@ -123,25 +123,25 @@ The following dashboards will display this information:
123
123
124
124
**Detection totals**
125
125
126
-
*Defender for Office Mailflow blocks*: Messages that MDO caught during mailflow. These are unique messages that the 3<sup>rd</sup> party did not catch.
126
+
-*Defender for Office Mailflow blocks*: Messages that MDO caught during mailflow. These are unique messages that the third-party did not catch.
127
127
128
-
*Defender for Office Post-delivery blocks*: Messages that MDO caught after delivery, through ZAP. These are unique messages that the 3<sup>rd</sup> party did not catch.
128
+
-*Defender for Office Post-delivery blocks*: Messages that MDO caught after delivery, through ZAP. These are unique messages that the third-party did not catch.
129
129
130
-
*Non-Microsoft Post-delivery blocks*: Messages that the thirdparty caught.
130
+
-*Non-Microsoft Post-delivery blocks*: Messages that the third-party caught.
131
131
132
-
*Duplicate blocks*: Messages that MDO caught during mailflow that the 3<sup>rd</sup> party also contributed a verdict on.
132
+
-*Duplicate blocks*: Messages that MDO caught during mailflow that the third-party also contributed a verdict on.
133
133
134
-
*Duplicate blocks (Defender for Office Post-delivery)*: Messages that MDO caught after delivery, through ZAP, that the 3<sup>rd</sup> party also contributed a verdict on.
134
+
-*Duplicate blocks (Defender for Office Post-delivery)*: Messages that MDO caught after delivery, through ZAP, that the third-party also contributed a verdict on.
135
135
136
136
**Post-delivery catch by non-Microsoft solutions**
137
137
138
-
- Shows the verdict types that the 3rd party provided on messages. This is a breakdown of the Non-Microsoft Post-delivery blocks field in the Detection Totals report.
138
+
- Shows the verdict types that the third-party provided on messages. This is a breakdown of the Non-Microsoft Post-delivery blocks field in the Detection Totals report.
139
139
140
140
## Frequently Asked Questions
141
141
142
142
**I have multiple ICES/CAPES solutions. How does that work?**
143
143
144
-
You can use this integration with multiple ICES/CAPES vendors as long as they're part of the API Vendor Ecosystem partnership. The integration will work the same, where each 3<sup>rd</sup> party will be able to provide verdicts on the messages in your mailboxes. You'll see the 3<sup>rd</sup> party catch and be able to identify which 3<sup>rd</sup> party the catch is attributed to, within the security portal experiences. If multiple 3<sup>rd</sup> parties send verdicts on the same message, both 3<sup>rd</sup> party verdicts and explainability will be logged. The highest verdict between the 3<sup>rd</sup> party verdicts will determine what action is taken on the message.
144
+
You can use this integration with multiple ICES/CAPES vendors as long as they're part of the API Vendor Ecosystem partnership. The integration will work the same, where each third-party will be able to provide verdicts on the messages in your mailboxes. You'll see the third-party catch and be able to identify which third-party the catch is attributed to, within the security portal experiences. If multiple third parties send verdicts on the same message, both third-party verdicts and explainability will be logged. The highest verdict between the third-party verdicts will determine what action is taken on the message.
145
145
146
146
**Which verdict takes precedence?**
147
147
@@ -163,17 +163,17 @@ Junk
163
163
164
164
Clean or Not Spam
165
165
166
-
**What if I utilize a different 3<sup>rd</sup> Party application?**
166
+
**What if I utilize a different third-party application?**
167
167
168
168
Currently, this integration only works for authorized partners which are Darktrace and KnowBe4. If you utilize a different ICES/CAPES vendor, you will not be able to take advantage of this integration.
169
169
170
-
**Will I be charged for the 3P verdict data and actioning by MDO policies?**
170
+
**Will I be charged for the third-party verdict data and actioning by MDO policies?**
171
171
172
172
No, there is no charge for the integration. The integration and Graph API support are included as part of your Microsoft Defender for Office 365 Plan 2 licenses.
173
173
174
174
**Why do I not see the Detection Totals and Post-delivery catch by non-Microsoft solutions reports?**
175
175
176
-
The reports will only show if you have had activity from one of the authorized 3rd Party partners in the past 90 days.
176
+
The reports will only show if you have had activity from one of the authorized third-party partners in the past 90 days.
0 commit comments