Incident investigation

2 Topics

Best Practices for Investigating Phishing Incidents in Microsoft Defender for Office 365
Discover best practices for investigating phishing incidents with Microsoft Defender for Office 365. Learn how to use the Incidents tab, analyze threats, and accelerate response with Security Copilot’s AI-powered guidance.
EunjiGil
Jun 20, 2025 Place Core Infrastructure and Security Blog
5.1KViews
4likes
0Comments
Confusing Evidence
I have a Stale Externally shared files involving one user incident that shows User Activity (1), but when I look at the Users Activities tab in M365 Defender is says "No user activities found". Has anyone else seen this type of inconsistency? Is this a known bug?
Dean_Gross
Mar 08, 2022 Place Microsoft Defender for Cloud Apps
772Views
0likes
0Comments