Forum Widgets
Latest Discussions
Pending actions notification via KQL / Graph API
Hello, I'm looking for a way to get notifications when an investigation is in Pending Approval state. I have tried searching the logs in Defender and Sentinel and have tried finding a graph request that could get this information, but no luck. Is this something that exists? Thank you for any help regarding this topic. KristofKristofDec 05, 2024Copper Contributor13Views0likes2CommentsDefender XDR - Resolved incidents still show up
In Security Center I have multiple incidents that I changed to status resolved. However, they still appear in the Incidents view. What could be the issue? I don't have this issue with resolving incidents in Sentinel.HendrikDec 05, 2024Occasional Reader4Views0likes0CommentsDefender - Cloud Activity Logs suspicious
Hi, I just noticed this logs from Defender - Cloud Apps > Activity Logs, seems all our Microsoft Cloud PC has these logs, looks suspicious for me as it is querying our Domain Admins account it seems, but would like to confirm. If this is suspicious, can help how to mitigate this please, thank you.Champ14-1020Dec 04, 2024Copper Contributor21Views0likes1CommentTracking Sent Emails from a Shared Mailbox with Delegated Access
Here is a detailed post to the Microsoft help forum about tracking down who sent emails from a shared mailbox with delegated access and send as rights: Title: Tracking Sent Emails from a Shared Mailbox with Delegated Access Dear Microsoft Community, I'm reaching out for assistance with an issue I'm encountering regarding a shared mailbox in my organization. The shared mailbox has been configured with delegated access and "Send As" rights for certain users. However, I'm finding that emails are being sent from this shared mailbox, and I need to determine which user is responsible for those sent messages. Here's some more context on the setup: We have a shared mailbox that multiple employees within my organization can access and send emails from using their individual user accounts. The shared mailbox has been granted "Delegate Access" and "Send As" rights to these authorized users. Whenever an email is sent from the shared mailbox, it appears to come from the shared mailbox address rather than the individual user's email address. I need to be able to track down and identify which user sent a specific email from the shared mailbox. My main questions are: How can I determine which user account was used to send a specific email from the shared mailbox? Is there logging or audit functionality within Microsoft 365 that would allow me to see the user who sent an email from the shared mailbox? Are there any third-party tools or add-ons that could provide this level of tracking and visibility for emails sent from a shared mailbox? I'm hoping the Microsoft community can provide some guidance and recommendations on the best approach to resolve this issue. Being able to identify the user responsible for emails sent from the shared mailbox is crucial for maintaining security and accountability within our organization. Thank you in advance for your assistance. I look forward to hearing back from the community. Best regards,Fish_TacosDec 02, 2024Brass Contributor18Views0likes0CommentsAdministrative activity from a non-corporate IP address
Hi, Defender XDR raises incidents almost every day regarding OneDrive for Business sharing policies. Event description is: Change sharing policy: OneDrive Site Collection <b>https://xxxx-my.sharepoint.com/personal/user_domain_fi</b>; Parameters: property <b>Share Using Anonymous Links</b> <b>True</b>, property <b>Share With Guests</b>, property <b>ShareUsingAnonymousLinks</b> <b>From False To True</b>, property <b>ShareUsingAnonymousLinks - New Value</b> <b>True</b> Anonymous links are not allowed and when checking users onedrive site collection settings after alert it is still not allowed. Are these only false positives? Matched policy is Administrative activity from a non-corporate IP address and Alert Product is Microsoft Defender for Cloud Apps ~ Jukka ~JVaDec 02, 2024Copper Contributor19Views0likes0Comments"Open Wi-Fi Connection on one endpoint" - network name is "hidden for privacy"?
Background: We have Defender for Endpoint, and Intune installed on our corporate Android devices. I'm not sure what changed recently but we are now getting tons of alerts everyday forOpen Wi-Fi Connection on one endpoint. When I go in to investigate further every alert says: Device ID : <<unique ID>> connected to an open Wi-Fi network : hidden for privacy Is there any way to see what the actual network connected to is, to determine if this is a risk or if it is just needs user education?MichaelL1930Nov 28, 2024Copper Contributor3.2KViews0likes3CommentsXDR Unified RBAC deadline
Has Microsoft set a date for when the Unified RBAC permission model will become mandatory? All the documents I've read indicate that it's voluntary right now. Eventually it will become the default. Permissions Management: Defender XDR's RBAC Walkthrough for Microsoft Defender for Office 365 | Microsoft Community Hub ChuckscenixNov 26, 2024Copper Contributor42Views1like0Comments- anuson_gangNov 25, 2024Copper Contributor20Views0likes0Comments
Defender for Endpoints - Domain Controllers
Hi What is the correct process for managing and deploying policies for Windows server 2019 domain controllers. I know thatSecurity settings management doesn't work on and isn't supported on 2019 DCs as per (https://learn.microsoft.com/en-us/mem/intune/protect/mde-security-integration?view=o365-worldwide#configure-your-tenant-to-support-microsoft-defender-for-endpoint-security-configuration-management So how do I manage and get policies to a 2019 DC ThanksSolved7.2KViews1like4Comments
Resources
Tags
- microsoft defender for endpoint295 Topics
- Microsoft Defender for Office 365209 Topics
- threat hunting100 Topics
- Alerts92 Topics
- investigation81 Topics
- Incident Management68 Topics
- automation63 Topics
- learning46 Topics
- threat intelligence37 Topics
- microsoft sentinel36 Topics