Azure Sentinel
@AzureSentinel50 followers965 downloads1,435 copies43 likes37,857 views
1,223 detections
Filters
Last updated
All Time
Detection languages
1,223
Categories
220
218
180
171
135
Platforms
766
284
188
78
29
Products / Services
492
297
159
152
93
MITRE Techniques
530
485
467
348
348
This query visualises top 10 subjects of intra-org emails submitted as false negatives by users.
This query visualises the total ammount of user false negative submissions from the junk folder
Identifies the top 10 sender domains delivering inbound emails classified as malware, phishing, or spam.
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
Identifies the top 10 users receiving inbound emails classified as malware, phishing, or spam.
Based on concepts from the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
Based on concepts from the Defender for Office 365 solution in Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
This query visualises the total ammount of user false negative or false positive submissions by the verdict of the submission grading.
Identifies the top 10 external sender addresses delivering inbound emails classified as phishing.
If you want to exclude your own organization's domains (including subdomains), add a filter after the phishing filter, e.g.:
| where SenderFromAddress !contains ".yourdomain.com"
(Replace "yourdomain.com" with your actual domain.)
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
If you want to exclude your own organization's domains (including subdomains), add a filter after the phishing filter, e.g.:
| where SenderFromAddress !contains ".yourdomain.com"
(Replace "yourdomain.com" with your actual domain.)
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
Identifies the top 10 external sender addresses delivering inbound emails classified as spam.
To exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:
| where SenderFromAddress !contains ".yourdomain.com"
(Replace "yourdomain.com" with your actual domain.)
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
To exclude your own organization's domains (including subdomains), add a filter after the spam filter, e.g.:
| where SenderFromAddress !contains ".yourdomain.com"
(Replace "yourdomain.com" with your actual domain.)
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
This query helps reviewing quarantine release trend in Defender for Office 365
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the workload in which they are stored
Page 7 of 123