Microsoft Threat Protection – Using advanced hunting to see what's going on with your mail

Wed, 15 Jan 2020 22:09:35 +0000

Last December Microsoft introduced Microsoft Threat Protection (MTP) including advanced hunting that allows us to run queries across multiple data sources i.e. Microsoft Defender ATP and Office 365 ATP. If you haven’t heard yet about MTP I recommend reading Christian Müller’s blog post Microsoft Threat Protection – unified huntingNow while the primary purpose of the unified hunting capability is to find information about indicators and entities, we can also use it to get an overview of what’s going on inside the systems that feed information into MTP i.e. Office 365. So, I created a few simple queries that summarizes various attributes from the EmailEvents table.

Hunting on Anything About IT

Microsoft Threat Protection – Using advanced hunting to see what's going on with your mail