Forum Discussion

TracMora's avatar
TracMora
Copper Contributor
Dec 08, 2021

Attack Simulator - deleted or reported to help desk

Within M365 Defender Attack Simulator are there ways (PowerShell/graph) to see user activity like email deleted associated with a particular simulation?    If users report the email via a ticketing...
microsoft 365 defender
ExMSW4319's avatar
ExMSW4319
Steel Contributor
Dec 22, 2021

TracMora 

 

As far as I am aware there has been no movement beyond the November statement saying no commandlets are available for the simulator:

 

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started?view=o365-worldwide

 

Simulated attacks do not appear to go through the normal delivery process (try an ordinary EXO message trace - there's nothing) so do not be surprised if some audit processes appear to fail.

 

As an MDO customer, definitely encourage the use of the Report Message add-in for Outlook. It will take the load off your service desk in simulated campaigns as well as improving ZAP times for real threats.

 

The problem with the add-in is that it handles the user statement "this mail is bad" rather that the user question "is this mail bad?" If your simulation is any good, you will get users calling in. You need to record those queries as part of your response rate (which you must measure) and prepare your service desk to answer without exposing the simulation.

 

I do my post-campaign reports off-tenancy in Excel. A commandlet to simply dump the results of a simulation direct to CSV would save some of the drudgery; we can hope.