May 21 2019
- last edited on
Feb 19 2021
I'm not sure if this is the right place. I have a large Office 365 tenant. I receive an insight/report regularly called, "Users targeted by malware campaigns." This last one has a long list of users targeted, perhaps 70. (You may be able to see how small the scroll button is.)
I would like to export the list so I can email the users and do other actions via script. However, I cannot find an export function, and when I try to copy and paste, I can only select the current screen view and not the entire list.
How can I get this list of users out to a file so that I can work with it? Thanks in advance.
May 21 2019 07:35 AM
May 21 2019 07:40 AM
@Christopher Hoard No, this is where it takes me.
If I click Users targeted by malware campaigns, then it brings up the first screen again.
May 21 2019 07:52 AM
May 21 2019 08:22 AMSolution
You should be able to see and export this data via Threat explorer: https://protection.office.com/threatexplorer
May 21 2019 08:26 AM
May 21 2019 08:35 AM
@Vasil Michev Can you give me a little more guidance, please? I go to Threat Explorer. I see a graph along with top malware and top targeted users. I click export email list and get a large spreadsheet with a variety of emails. Is this the "Users targeted by malware campaigns" list? It doesn't look the same at all.
May 21 2019 10:43 PM
That's the dataset on which the "insight" is based, you need to simply filter/pivot it to get the same exact view.
May 22 2019 05:16 AM
@Vasil Michev OK, how do I do that? What is the step-by-step to use Threat Explorer to come up with the Users Targeted by Malware Campaign?
May 22 2019 08:46 AM
Simply use the filter functionality in Excel? Or are you saying that the relevant data points are not present in the exported file?
May 22 2019 11:11 AM
@Vasil Michev What are the criteria for the Insight called "Users Targeted by Malware Campaign"? I don't know how to reproduce it.
May 22 2019 10:29 PM
It's the same data you see on the threat explorer, just presented differently (aggregated by user).