The Office 365 Security and Compliance Center already provides access to malware trends, real-time reports, and granular threat details. We are now adding organizational insights such as anomalous behavior or repeat policy offenders. These insights are presented both in the reports and in the threat dashboard, correlating signals from a broad range of data to help identify, prioritize, and provide recommendations on how to address potential problems. The recommendations are generally remediation actions empowering admins to proactively secure their organization. The insights are holistic and cover both information and threat protection.
Threat Protection Insights include:
Policy or end user configurations (e.g. transport or mail flow rules, custom policy settings, junk mail folder settings) that can be improved to block delivery of malware, phish, or spam.
Policies and configurations enhancing protection for users targeted by malware and phishing campaigns in an organization.
Figure 1.. Threat protection insights in the Security dashboard in the Security and Compliance Center
Soon we will release an enhanced Threat Protection status trending report, offering a single view with drill downs into malicious emails identified within the organization, including detection details for malware and phish.
Figure 2. Threat protection status report with email malware and phish detections in the Security and Compliance Center
Information Protection Insights include:
Views into users who violate large volumes of Office 365 Data Loss Prevention (DLP) policies
Anomaly insights showing unusual trends in your DLP policy violations
We are also introducing a new report of DLP policy matches on a per item level enabling easier identification of documents or emails which violate policies.
Figure 3. DLP incident report with information protection insights embedded in the Security and Compliance Center
‘Delete’ removes the file from quarantine; however, the file is still blocked in SharePoint Online, OneDrive for Business and Microsoft Teams and must be deleted from the respective document libraries in these services to preserve content specific audited activities
Figure 5. Malicious files detected by Office 365 ATP with actions to release, report, download and delete the files from quarantine
Now admins can create policies to send filtered messages to quarantine when they were identified as spam, bulk, phish, or when they match a mail flow rule. By default, Office 365 sends phishing messages and messages containing malware directly to quarantine. Other filtered messages are sent to users' Junk Email folder unless the policy specifies sending them to quarantine.
Send Us Your Feedback
Your valuable feedback enables us to continue improving and adding features that support the goal of making Office 365 more secure. We encourage you to begin a free Office 365 E5 trial today and begin further enhancing your security for Office 365 today.