User Profile
CodnChips
Brass Contributor
Joined 4 years ago
User Widgets
Recent Discussions
Re: Edit a single watchlist item
A logicApp does seem a bit like "a sledgehammer to crack a walnut" and I don't like that using them incurs cost. In order to manage\maintain threat intelligence, basic list admin should be a fundamental piece of functionality within the interface. I'll find somewhere to raise it as a feature request.Edit a single watchlist item
Hi, I have a watchlist, let's say it has 3000 watchlist items present. I want to modify the value of an entry - an IP address that is no longer required. Can I edit this programmatically? At present I manually have to scroll through each page of results with a CTRL+F to find on the page which is really lame. Surely there must be a better way?Restricted Sender
I've got a user that send a load of messages that triggered the outbound spam policy and placed them on the restricted senders list. The 365 Defender investigations have completed (Partial remediation because I declined the password reset as it wasn't necessary). User is removed from the Restricted users list and doesn't appear if you query from Exchange powershell. The outbound spam policy does not prevent sending for 24 hours. They were receiving: This message couldn't be delivered because the sending email address was not recognized as a valid sender. The most common reason for this error is that the email address is, or was, suspected of sending spam. Contact the organization's email admin for help and give them this error message. And also: Remote Server returned '550 5.1.8 Access denied, bad outbound sender AS(42004)' Where do I go? Many thanksWhen is malware not malware?
My 365 Defender Dashboard has populated the "Devices with active Malware" tile, with 1 affected device, I view the details, locate the device and check on the device page. The risk level has nothing and no 365 and Sentinel incidents triggered. If I hunt through the timeline, no malware\av events are displayed. If I use the Advanced Threat hunting and run this, I get nothing: For a sanity check, if I remove the device element, still nothing: I've gone to Sentinel and searched the SecurityAlert table for entities containing the hostname and had a return for AD Account Disabled (It is currently enabled). The owner didn't mention this but I think this is possibly part of the cause. Does anyone have any experience with this mismatch of information? ThanksHash types & watchlists
Hi, when creating watchlists, up to this point, if I have an IOC filename & the MD5, SHA1 & SHA256 hashes, I would add all entries onto the watchlist. I recently discovered that in 365 defender, there is no need to add all 3 as only the longest will be obeyed. Therefore what's the best practice for Sentinel? Should I\do I need to add all 3 hash versions?
