Part 4: See, investigate, and measure email and collaboration attacks with Defender reporting

Attacks rarely stay in one channel. A flood of spam email, a Teams chat from an unfamiliar organization, and a call from "the helpdesk" can all be part of the same attempt. Security teams need a unified way to see where attacks are happening across email and collaboration, investigate them quickly, and show whether their defenses and users are improving.

That's the job of our Detections and Insights reports. They're ready-to-use templates that turn Defender's email and collaboration data into views your team can use every day, as a Microsoft Sentinel workbook or a Power BI report.

Today we're releasing version 4, which builds on Part 3 of this series, with new hunting queries and a new report for attack simulation training. Shaped by customer feedback, it helps you:

• See the attacks that matter with new Teams and impersonation views.
• Investigate faster with 125 new or improved hunting queries.
• Measure and improve resilience with a new attack simulation training report.

See the attacks that matter

In September, Microsoft Threat Intelligence described a campaign that starts on Teams: an attacker from another organization poses as IT support in a chat or call and talks the user into a remote session. Spotting activity like this early means looking at Teams alongside email.

The new Teams & Collaboration view puts those Teams signals in one place: threats in chats and channels, callers and senders with support-style names such as "IT Helpdesk", new external senders, risky links, and the calls and messages users reported. A new Email – Impersonation & BEC tab in the workbook does the same for email, highlighting impersonation attempts that reached an inbox and the people they targeted.

Each major workbook tab now opens with key numbers and recommended actions, so the team can go from "what happened?" to "what should we check next?" in one place. 

In Microsoft Sentinel, the workbook can also combine several workspaces in one view, which helps managed security service providers (MSSPs) and organizations with many tenants.

The Teams & Collaboration view and the Email – Impersonation & BEC tab, shown with test data from a lab tenant.

Investigate faster

When something needs a closer look, the next questions come quickly. Has this sender contacted us before? Did anyone report a call from them? Are several addresses using the same "IT Helpdesk" display name?

To help answer them, we added 71 new hunting queries for email and collaboration and improved 54 existing ones. They're available now in the Defender portal as advanced hunting community queries, including a Microsoft Teams protection folder that covers suspicious caller identities, new external senders, user-reported calls, and impersonation patterns.

Run them as is or adapt them to your environment. Once a query is tuned and validated, it can become a custom detection rule, so similar activity raises an alert next time. Explore the Teams hunting queries.

Community queries in advanced hunting, with results from the Suspicious Teams Display Name query.

Measure and improve resilience

Seeing attacks is only part of the picture. Security and awareness teams also need to show whether people are getting better at recognizing them, and customers asked us for a clearer way to do that.

The new Attack Simulation Training Insights report for Power BI complements the built-in simulation reports. It brings simulation results, training progress, and details such as department into one view, so leaders and awareness teams can track over time who clicks, who reports, repeat offenders, and who still needs training.

That makes it easier to show progress and focus training where it's needed most, starting with the people the Detections and Insights reports show as most targeted.

Attack Simulation Training Insights, shown with sample data from a test tenant.

Get started

• Detections and Insights workbook
  • Microsoft Sentinel: In Content Hub, install or update the Microsoft Defender XDR solution (version 3.0.18 or later), then save a new workbook from the Detections and Insights template. Your existing workbooks stay as they are.
  • Defender portal (preview): If your tenant has the integrated security operations center (ISOC) preview, import the ISOC version from GitHub into Workbooks for a more unified experience.
• Power BI templates (download from GitHub, then follow the setup guide in each folder)
  • Detections and Insights: version 4, now with Teams & Collaboration reporting.
  • Attack Simulation Training Insights: the new report for simulation and training results.
• Hunting queries: In advanced hunting, open the Queries tab and expand Community queries. The Teams queries are in the Microsoft Teams protection folder.

Get the templates and setup guides on GitHub.

Thank you to everyone who shared feedback on earlier versions. Tell us in the comments what you'd like to see next.