Validating Microsoft Defender for Storage Detections

Hello IrynaH - unfortunately we can't make this assumption due the way that this threat detection works. The current solution is based on Storage’s telemetry stream. The stream contains logs of operations that were performed on ATP enabled storage accounts. Some, but not all, of these operation logs contain hashes of the related blob or file, and we can then compare this to our threat intelligence data. However there are many cases where no such hash is present in the telemetry. As I mentioned, we have a working in progress to reduce this time to minutes. Thanks for checking!