export Users targeted by malware campaigns Report

[Roger Seekell]

I'm not sure if this is the right place.  I have a large Office 365 tenant.  I receive an insight/report regularly called, "Users targeted by malware campaigns."  This last one has a long list of users targeted, perhaps 70.  (You may be able to see how small the scroll button is.)

I would like to export the list so I can email the users and do other actions via script.  However, I cannot find an export function, and when I try to copy and paste, I can only select the current screen view and not the entire list.

How can I get this list of users out to a file so that I can work with it?  Thanks in advance.

[#2]

Hi!

In the screenshot down the bottom it says see report associated with insight - can you export that report?

Let me know how it goes!

Best, Chris

[#3]

@ChrisHoardMVP   No, this is where it takes me.

If I click Users targeted by malware campaigns, then it brings up the first screen again.

[#4]

Hmm @Ryan Heffernan is there a way to export the users targeted by malware insight from the Microsoft 365 admin portal currently?

Best, Chris

[#5 · Accepted solution]

You should be able to see and export this data via Threat explorer: https://protection.office.com/threatexplorer

[#6]

Thanks @VasilMichev - appreciate that couldn’t remember where it was and then started to doubt whether it was currently possible.

Best, Chris

[#7]

@VasilMichev Can you give me a little more guidance, please? I go to Threat Explorer. I see a graph along with top malware and top targeted users.  I click export email list and get a large spreadsheet with a variety of emails.  Is this the "Users targeted by malware campaigns" list?  It doesn't look the same at all.

[#8]

That's the dataset on which the "insight" is based, you need to simply filter/pivot it to get the same exact view.

[#9]

@VasilMichev  OK, how do I do that? What is the step-by-step to use Threat Explorer to come up with the Users Targeted by Malware Campaign?

[#10]

Simply use the filter functionality in Excel? Or are you saying that the relevant data points are not present in the exported file?

[#11]

@VasilMichev What are the criteria for the Insight called "Users Targeted by Malware Campaign"?  I don't know how to reproduce it.

[#12]

It's the same data you see on the threat explorer, just presented differently (aggregated by user). 

[#13]

Hi
Please what should be the incident response to the alert "users targeted by malware campaigns" or next line of action after getting the alert.