Microsoft Defender XDR (formerly Microsoft 365 Defender) is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks.
With the Microsoft Defender XDR content pack, you can determine how a threat entered your environment and what part of your organization is affected.
Available for Office 365 E5, Microsoft 365 E5, and standalone licenses.
With the Microsoft Defender XDR content pack, you can determine how a threat entered your environment and what part of your organization is affected.
Available for Office 365 E5, Microsoft 365 E5, and standalone licenses.
| Name | Description |
|---|---|
| MS365DefenderCountIncidentCategories | count the categories of alerts in given incident |
| MS365DefenderUserListToTable | comment |
| Name | Description |
|---|---|
Microsoft 365 Defender - Incoming Mapper | Classifies Microsoft 365 Defender's events |
| Name | Description |
|---|---|
Microsoft 365 Defender Tags | |
Microsoft 365 Defender Users | |
Microsoft 365 Defender First activity | |
Microsoft 365 Defender Status | |
Microsoft 365 Defender Last activity | |
Microsoft 365 Defender ID | |
Microsoft 365 Defender Display Name | |
Microsoft 365 Defender Devices | |
Microsoft 365 Defender Classification | |
Microsoft 365 Defender Categories count | |
impacted devices | |
Microsoft 365 Defender A | |
Microsoft 365 Defender Active | |
impacted entities |
| Name | Description |
|---|---|
Microsoft 365 Defender Incident |
| Name | Description |
|---|---|
| Microsoft 365 Defender | Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. |
| O365 Defender SafeLinks | Provides URL scanning and rewriting of inbound email messages in mail flow, and time-of-click verification of URLs and links in email messages and other locations. |
| O365 Defender SafeLinks - Single User (Deprecated) | Deprecated. Use O365 Defender SafeLinks instead. Enables URL scanning, rewriting inbound email messages in the mail flow, time-of-click URL verification, and links in email messages and other locations. |
| Name | Description |
|---|---|
Microsoft 365 Defender - Layout | Microsoft 365 layout page |
| Name | Description |
|---|---|
| Microsoft 365 Defender - Get Email URL Clicks | This playbook retrieves email data based on the URLDomain - If the “URLDomain” value is found as a substring of the URL(s) in the body of the email, the email is retrieved. MessageID - The message ID of the email from which the URL was clicked. Note that this can be either of the following 2 values:
Can be a single MessageID or an array of MessageIDs to search. |
| Microsoft 365 Defender - Threat Hunting Generic | This playbook retrieves email data based on the
Read the playbook's descriptions in order to get the full details. |
| Microsoft 365 Defender - Emails Indicators Hunt | This playbook retrieves email data based on the "URLDomain", "SHA256" and "IPAddress" inputs. |
| Name | Description |
|---|---|
| MS365DefenderUserListToTable | comment |
| MS365DefenderCountIncidentCategories | count the categories of alerts in given incident |
| Name | Description |
|---|---|
Microsoft 365 Defender - Incoming Mapper | Classifies Microsoft 365 Defender's events |
| Name | Description |
|---|---|
Microsoft 365 Defender ID | |
Microsoft 365 Defender Status | |
Microsoft 365 Defender A | |
Microsoft 365 Defender Tags | |
Microsoft 365 Defender Active | |
Microsoft 365 Defender Display Name | |
Microsoft 365 Defender First activity | |
Microsoft 365 Defender Classification | |
Microsoft 365 Defender Devices | |
impacted devices | |
impacted entities | |
Microsoft 365 Defender Last activity | |
Microsoft 365 Defender Categories count |
| Name | Description |
|---|---|
Microsoft 365 Defender Incident |
| Name | Description |
|---|---|
| Microsoft 365 Defender | Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. |
| O365 Defender SafeLinks - Single User (Deprecated) | Deprecated. Use O365 Defender SafeLinks instead. Enables URL scanning, rewriting inbound email messages in the mail flow, time-of-click URL verification, and links in email messages and other locations. |
| O365 Defender SafeLinks | Provides URL scanning and rewriting of inbound email messages in mail flow, and time-of-click verification of URLs and links in email messages and other locations. |
| Name | Description |
|---|---|
| Microsoft 365 Defender - Emails Indicators Hunt | This playbook retrieves email data based on the "URLDomain", "SHA256" and "IPAddress" inputs. |
| Microsoft 365 Defender - Get Email URL Clicks | This playbook retrieves email data based on the URLDomain - If the “URLDomain” value is found as a substring of the URL(s) in the body of the email, the email is retrieved. MessageID - The message ID of the email from which the URL was clicked. Note that this can be either of the following 2 values:
Can be a single MessageID or an array of MessageIDs to search. |
| Microsoft 365 Defender - Threat Hunting Generic | This playbook retrieves email data based on the
Read the playbook's descriptions in order to get the full details. |
| Pack Name | Pack By |
|---|---|
| Base | By: Cortex XSOAR |
| Common Scripts | By: Cortex XSOAR |
| Filters And Transformers | By: Cortex XSOAR |
| Pack Name | Pack By |
|---|---|
| Common Types | By: Cortex XSOAR |
| Pack Name | Pack By |
|---|---|
| Base | By: Cortex XSOAR |
| Common Scripts | By: Cortex XSOAR |
| Cortex REST API | By: Cortex XSOAR |
| Filters And Transformers | By: Cortex XSOAR |
Retrieve emails data (URLDomain)Retrieve emails data (URLDomain)exchange_online endpoints.Rebranded Microsoft 365 Defender to Microsoft Defender XDR.
Rebranded Microsoft 365 Defender to Microsoft Defender XDR.
| Certification | Certified | Read more |
| Supported By | Cortex | |
| Created | May 25, 2021 | |
| Last Release | December 3, 2024 |
