Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks.
With the Microsoft 365 Defender content pack, you can determine how a threat entered your environment and what part of your organization is affected.
Available for Office 365 E5, Microsoft 365 E5, and standalone licenses.
| Name | Description |
|---|---|
Microsoft 365 Defender Incident |
| Name | Description |
|---|---|
| O365 Defender SafeLinks | Provides URL scanning and rewriting of inbound email messages in mail flow, and time-of-click verification of URLs and links in email messages and other locations. |
| O365 Defender SafeLinks - Single User | Enables URL scanning, rewriting inbound email messages in the mail flow, time-of-click URL verification, and links in email messages and other locations. |
| Microsoft 365 Defender | Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. |
| Name | Description |
|---|---|
Microsoft 365 Defender - Incoming Mapper | Classifies Microsoft 365 Defender's events |
| Name | Description |
|---|---|
Microsoft 365 Defender First activity | |
Microsoft 365 Defender Categories count | |
Microsoft 365 Defender Display Name | |
Microsoft 365 Defender A | |
Microsoft 365 Defender Classification | |
Microsoft 365 Defender Devices | |
Microsoft 365 Defender Status | |
impacted devices | |
Microsoft 365 Defender Tags | |
Microsoft 365 Defender ID | |
impacted entities | |
Microsoft 365 Defender Active | |
Microsoft 365 Defender Users | |
Microsoft 365 Defender Last activity |
| Name | Description |
|---|---|
MS365DefenderUserListToTable | comment |
MS365DefenderCountIncidentCategories | count the categories of alerts in given incident |
| Name | Description |
|---|---|
Microsoft 365 Defender - Layout | Microsoft 365 layout page |
| Name | Description |
|---|---|
| Microsoft 365 Defender - Get Email URL Clicks | This playbook retrieves email data based on the URLDomain - If the “URLDomain” value is found as a substring of the URL(s) in the body of the email, the email is retrieved. MessageID - The message ID of the email from which the URL was clicked. Note that this can be either of the following 2 values:
Can be a single MessageID or an array of MessageIDs to search. |
| Microsoft 365 Defender - Threat Hunting Generic | This playbook retrieves email data based on the
Read the playbook's descriptions in order to get the full details. |
| Microsoft 365 Defender - Emails Indicators Hunt | This playbook retrieves email data based on the "URLDomain", "SHA256" and "IPAddress" inputs. |
| Name | Description |
|---|---|
Microsoft 365 Defender Incident |
| Name | Description |
|---|---|
| O365 Defender SafeLinks | Provides URL scanning and rewriting of inbound email messages in mail flow, and time-of-click verification of URLs and links in email messages and other locations. |
| O365 Defender SafeLinks - Single User | Enables URL scanning, rewriting inbound email messages in the mail flow, time-of-click URL verification, and links in email messages and other locations. |
| Microsoft 365 Defender | Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. |
| Name | Description |
|---|---|
Microsoft 365 Defender - Incoming Mapper | Classifies Microsoft 365 Defender's events |
| Name | Description |
|---|---|
Microsoft 365 Defender First activity | |
Microsoft 365 Defender Categories count | |
Microsoft 365 Defender Display Name | |
Microsoft 365 Defender A | |
Microsoft 365 Defender Classification | |
Microsoft 365 Defender Devices | |
Microsoft 365 Defender Status | |
impacted devices | |
Microsoft 365 Defender Tags | |
Microsoft 365 Defender ID | |
impacted entities | |
Microsoft 365 Defender Active | |
Microsoft 365 Defender Last activity |
| Name | Description |
|---|---|
MS365DefenderUserListToTable | comment |
MS365DefenderCountIncidentCategories | count the categories of alerts in given incident |
| Name | Description |
|---|---|
| Microsoft 365 Defender - Get Email URL Clicks | This playbook retrieves email data based on the URLDomain - If the “URLDomain” value is found as a substring of the URL(s) in the body of the email, the email is retrieved. MessageID - The message ID of the email from which the URL was clicked. Note that this can be either of the following 2 values:
Can be a single MessageID or an array of MessageIDs to search. |
| Microsoft 365 Defender - Threat Hunting Generic | This playbook retrieves email data based on the
Read the playbook's descriptions in order to get the full details. |
| Microsoft 365 Defender - Emails Indicators Hunt | This playbook retrieves email data based on the "URLDomain", "SHA256" and "IPAddress" inputs. |
| Pack Name | Pack By |
|---|---|
| Common Scripts | By: Cortex XSOAR |
| Filters And Transformers | By: Cortex XSOAR |
| Base | By: Cortex XSOAR |
| Pack Name | Pack By |
|---|---|
| EWS | By: Cortex XSOAR |
| Common Types | By: Cortex XSOAR |
| Pack Name | Pack By |
|---|---|
| Filters And Transformers | By: Cortex XSOAR |
| Remote Access | By: Cortex XSOAR |
| Active Directory Query | By: Cortex XSOAR |
| Common Scripts | By: Cortex XSOAR |
| Slack | By: Cortex XSOAR |
| MITRE ATT&CK | By: Cortex XSOAR |
| Google Maps | By: Cortex XSOAR |
This playbook retrieves email data based on the URLDomain and MessageID inputs. Its use the Microsoft 365 Defender's Advanced Hunting to search only for URL click events based on the playbook inputs and enriches it with the full email data.
URLDomain - If the “URLDomain” value is found as a substring of URL(s) in the body of the email, the email is retrieved.
MessageID - The message ID of the email from which the URL was clicked. Note that this can be either of the following 2 values:
URLDomain, SHA256, IPAddress and MessageID inputs. The output is a unified object with all of the retrieved emails based on the sub-playbooks outputs:WARNING: This version is invalid. Please install a different version.
Cortex
| Certification | Certified | Read more |
| Supported By | Cortex | |
| Created | May 25, 2021 | |
| Last Release | February 1, 2023 |
