Microsoft 365 Defender

count the categories of alerts in given incident

comment

Classifies Microsoft 365 Defender's events

Provides URL scanning and rewriting of inbound email messages in mail flow, and time-of-click verification of URLs and links in email messages and other locations.

Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks.

Enables URL scanning, rewriting inbound email messages in the mail flow, time-of-click URL verification, and links in email messages and other locations.

Microsoft 365 layout page

This playbook retrieves email data based on the URLDomain, SHA256, IPAddress. and MessageID inputs. The output is a unified object with all of the retrieved emails based on the following sub-playbooks outputs:

• Microsoft 365 Defender - Get Email URL clicks:
  Retrieves data based on URL click events.

• Microsoft 365 Defender - Emails Indicators Hunt:
  Retrieves data based on several different email events.

Read the playbook's descriptions in order to get the full details.

This playbook retrieves email data based on the "URLDomain", "SHA256" and "IPAddress" inputs.
SHA256 - Emails with attachments matching the "SHA256" input are retrieved.
URLDomain - If the "URLDomain" value is found as a substring of URL(s) in the body of the email, the email is retrieved.
IPAddress - Emails with "SenderIPv4"/SenderIPv6" or URLs (in the body) matching the "IPAddress" input are retrieved.

This playbook retrieves email data based on the URLDomain and MessageID inputs. It uses the Microsoft 365 Defender's Advanced Hunting to search only for URL click events based on the playbook inputs and enriches it with the full email data.

URLDomain - If the “URLDomain” value is found as a substring of the URL(s) in the body of the email, the email is retrieved.

MessageID - The message ID of the email from which the URL was clicked. Note that this can be either of the following 2 values:

• The value of the header "Message-ID".
• The internal ID of the message within Microsoft's products (e.g., NetworkMessageId).

Can be a single MessageID or an array of MessageIDs to search.

count the categories of alerts in given incident

comment

Classifies Microsoft 365 Defender's events

Provides URL scanning and rewriting of inbound email messages in mail flow, and time-of-click verification of URLs and links in email messages and other locations.

Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks.

Enables URL scanning, rewriting inbound email messages in the mail flow, time-of-click URL verification, and links in email messages and other locations.

This playbook retrieves email data based on the URLDomain, SHA256, IPAddress. and MessageID inputs. The output is a unified object with all of the retrieved emails based on the following sub-playbooks outputs:

• Microsoft 365 Defender - Get Email URL clicks:
  Retrieves data based on URL click events.

• Microsoft 365 Defender - Emails Indicators Hunt:
  Retrieves data based on several different email events.

Read the playbook's descriptions in order to get the full details.

This playbook retrieves email data based on the URLDomain and MessageID inputs. It uses the Microsoft 365 Defender's Advanced Hunting to search only for URL click events based on the playbook inputs and enriches it with the full email data.

URLDomain - If the “URLDomain” value is found as a substring of the URL(s) in the body of the email, the email is retrieved.

MessageID - The message ID of the email from which the URL was clicked. Note that this can be either of the following 2 values:

• The value of the header "Message-ID".
• The internal ID of the message within Microsoft's products (e.g., NetworkMessageId).

Can be a single MessageID or an array of MessageIDs to search.

This playbook retrieves email data based on the "URLDomain", "SHA256" and "IPAddress" inputs.
SHA256 - Emails with attachments matching the "SHA256" input are retrieved.
URLDomain - If the "URLDomain" value is found as a substring of URL(s) in the body of the email, the email is retrieved.
IPAddress - Emails with "SenderIPv4"/SenderIPv6" or URLs (in the body) matching the "IPAddress" input are retrieved.