SOLVED

export Users targeted by malware campaigns Report

%3CLINGO-SUB%20id%3D%22lingo-sub-623366%22%20slang%3D%22en-US%22%3Eexport%20Users%20targeted%20by%20malware%20campaigns%20Report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-623366%22%20slang%3D%22en-US%22%3E%3CP%3EI'm%20not%20sure%20if%20this%20is%20the%20right%20place.%26nbsp%3B%20I%20have%20a%20large%20Office%20365%20tenant.%26nbsp%3B%20I%20receive%20an%20insight%2Freport%20regularly%20called%2C%20%22Users%20targeted%20by%20malware%20campaigns.%22%26nbsp%3B%20This%20last%20one%20has%20a%20long%20list%20of%20users%20targeted%2C%20perhaps%2070.%26nbsp%3B%20(You%20may%20be%20able%20to%20see%20how%20small%20the%20scroll%20button%20is.)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20would%20like%20to%20export%20the%20list%20so%20I%20can%20email%20the%20users%20and%20do%20other%20actions%20via%20script.%26nbsp%3B%20However%2C%20I%20cannot%20find%20an%20export%20function%2C%20and%20when%20I%20try%20to%20copy%20and%20paste%2C%20I%20can%20only%20select%20the%20current%20screen%20view%20and%20not%20the%20entire%20list.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHow%20can%20I%20get%20this%20list%20of%20users%20out%20to%20a%20file%20so%20that%20I%20can%20work%20with%20it%3F%26nbsp%3B%20Thanks%20in%20advance.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-623366%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECompliance%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-623377%22%20slang%3D%22en-US%22%3ERe%3A%20export%20Users%20targeted%20by%20malware%20campaigns%20Report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-623377%22%20slang%3D%22en-US%22%3EHi!%3CBR%20%2F%3E%3CBR%20%2F%3EIn%20the%20screenshot%20down%20the%20bottom%20it%20says%20see%20report%20associated%20with%20insight%20-%20can%20you%20export%20that%20report%3F%3CBR%20%2F%3E%3CBR%20%2F%3ELet%20me%20know%20how%20it%20goes!%3CBR%20%2F%3E%3CBR%20%2F%3EBest%2C%20Chris%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-623379%22%20slang%3D%22en-US%22%3ERe%3A%20export%20Users%20targeted%20by%20malware%20campaigns%20Report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-623379%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F169605%22%20target%3D%22_blank%22%3E%40Christopher%20Hoard%3C%2FA%3E%26nbsp%3B%20%26nbsp%3BNo%2C%20this%20is%20where%20it%20takes%20me.%3C%2FP%3E%3CP%3EIf%20I%20click%26nbsp%3BUsers%20targeted%20by%20malware%20campaigns%2C%20then%20it%20brings%20up%20the%20first%20screen%20again.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-623448%22%20slang%3D%22en-US%22%3ERe%3A%20export%20Users%20targeted%20by%20malware%20campaigns%20Report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-623448%22%20slang%3D%22en-US%22%3EHmm%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F44888%22%20target%3D%22_blank%22%3E%40Ryan%20Heffernan%3C%2FA%3E%20is%20there%20a%20way%20to%20export%20the%20users%20targeted%20by%20malware%20insight%20from%20the%20Microsoft%20365%20admin%20portal%20currently%3F%3CBR%20%2F%3E%3CBR%20%2F%3EBest%2C%20Chris%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-623597%22%20slang%3D%22en-US%22%3ERe%3A%20export%20Users%20targeted%20by%20malware%20campaigns%20Report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-623597%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20should%20be%20able%20to%20see%20and%20export%20this%20data%20via%26nbsp%3BThreat%20explorer%3A%26nbsp%3B%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%3CA%20href%3D%22https%3A%2F%2Fprotection.office.com%2Fthreatexplorer%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fprotection.office.com%2Fthreatexplorer%3C%2FA%3E%3C%2FFONT%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-623623%22%20slang%3D%22en-US%22%3ERe%3A%20export%20Users%20targeted%20by%20malware%20campaigns%20Report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-623623%22%20slang%3D%22en-US%22%3EThanks%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%20-%20appreciate%20that%20couldn%E2%80%99t%20remember%20where%20it%20was%20and%20then%20started%20to%20doubt%20whether%20it%20was%20currently%20possible.%3CBR%20%2F%3E%3CBR%20%2F%3EBest%2C%20Chris%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-623777%22%20slang%3D%22en-US%22%3ERe%3A%20export%20Users%20targeted%20by%20malware%20campaigns%20Report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-623777%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3BCan%20you%20give%20me%20a%20little%20more%20guidance%2C%20please%3F%20I%20go%20to%20Threat%20Explorer.%20I%20see%20a%20graph%20along%20with%20top%20malware%20and%20top%20targeted%20users.%26nbsp%3B%20I%20click%20export%20email%20list%20and%20get%20a%20large%20spreadsheet%20with%20a%20variety%20of%20emails.%26nbsp%3B%20Is%20this%20the%20%22Users%20targeted%20by%20malware%20campaigns%22%20list%3F%26nbsp%3B%20It%20doesn't%20look%20the%20same%20at%20all.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-632320%22%20slang%3D%22en-US%22%3ERe%3A%20export%20Users%20targeted%20by%20malware%20campaigns%20Report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-632320%22%20slang%3D%22en-US%22%3E%3CP%3EThat's%20the%20dataset%20on%20which%20the%20%22insight%22%20is%20based%2C%20you%20need%20to%20simply%20filter%2Fpivot%20it%20to%20get%20the%20same%20exact%20view.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-633125%22%20slang%3D%22en-US%22%3ERe%3A%20export%20Users%20targeted%20by%20malware%20campaigns%20Report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-633125%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3B%20OK%2C%20how%20do%20I%20do%20that%3F%20What%20is%20the%20step-by-step%20to%20use%20Threat%20Explorer%20to%20come%20up%20with%20the%20Users%20Targeted%20by%20Malware%20Campaign%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-633745%22%20slang%3D%22en-US%22%3ERe%3A%20export%20Users%20tted%20by%20malware%20campaigns%20Report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-633745%22%20slang%3D%22en-US%22%3E%3CP%3ESimply%20use%20the%20filter%20functionality%20in%20Excel%3F%20Or%20are%20you%20saying%20that%20the%20relevant%20data%20points%20are%20not%20present%20in%20the%20exported%20file%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-634292%22%20slang%3D%22en-US%22%3ERe%3A%20export%20Users%20targeted%20by%20malware%20campaigns%20Report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-634292%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%26nbsp%3BWhat%20are%20the%20criteria%20for%20the%20Insight%20called%20%22Users%20Targeted%20by%20Malware%20Campaign%22%3F%26nbsp%3B%20I%20don't%20know%20how%20to%20reproduce%20it.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-636545%22%20slang%3D%22en-US%22%3ERe%3A%20export%20Users%20targeted%20by%20malware%20campaigns%20Report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-636545%22%20slang%3D%22en-US%22%3E%3CP%3EIt's%20the%20same%20data%20you%20see%20on%20the%20threat%20explorer%2C%20just%20presented%20differently%20(aggregated%20by%20user).%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

I'm not sure if this is the right place.  I have a large Office 365 tenant.  I receive an insight/report regularly called, "Users targeted by malware campaigns."  This last one has a long list of users targeted, perhaps 70.  (You may be able to see how small the scroll button is.)

 

I would like to export the list so I can email the users and do other actions via script.  However, I cannot find an export function, and when I try to copy and paste, I can only select the current screen view and not the entire list.

 

How can I get this list of users out to a file so that I can work with it?  Thanks in advance.

11 Replies
Hi!

In the screenshot down the bottom it says see report associated with insight - can you export that report?

Let me know how it goes!

Best, Chris

@Christopher Hoard   No, this is where it takes me.

If I click Users targeted by malware campaigns, then it brings up the first screen again.

Hmm @Ryan Heffernan is there a way to export the users targeted by malware insight from the Microsoft 365 admin portal currently?

Best, Chris
best response confirmed by Christopher Hoard (MVP)
Solution

You should be able to see and export this data via Threat explorer: https://protection.office.com/threatexplorer

Thanks @Vasil Michev - appreciate that couldn’t remember where it was and then started to doubt whether it was currently possible.

Best, Chris

@Vasil Michev Can you give me a little more guidance, please? I go to Threat Explorer. I see a graph along with top malware and top targeted users.  I click export email list and get a large spreadsheet with a variety of emails.  Is this the "Users targeted by malware campaigns" list?  It doesn't look the same at all.

That's the dataset on which the "insight" is based, you need to simply filter/pivot it to get the same exact view.

@Vasil Michev  OK, how do I do that? What is the step-by-step to use Threat Explorer to come up with the Users Targeted by Malware Campaign?

Simply use the filter functionality in Excel? Or are you saying that the relevant data points are not present in the exported file?

@Vasil Michev What are the criteria for the Insight called "Users Targeted by Malware Campaign"?  I don't know how to reproduce it.

It's the same data you see on the threat explorer, just presented differently (aggregated by user).