User Profile
Oren_Saban
Former Employee
Joined 6 years ago
User Widgets
Recent Discussions
Re: Block The URL and User
Ravi Harariya It depends which products are deployed in your environment, and where you would like to enforce the block, but in general: 1. Blocking users: Remediation actions in Microsoft Defender for Identity - Microsoft Defender for Identity | Microsoft Learn 2. Blocking senders (of emails): Create blocked sender lists - Office 365 | Microsoft Learn 3. Blocking URL in Defender for Endpoint (put in mind you have to enable network protection for this to work on non-Microsoft browsers): Create indicators for IPs and URLs/domains | Microsoft Learn 4. Block URL in Defender for Office: Allow or block URLs using the Tenant Allow/Block List - Office 365 | Microsoft Learn Hope it helps 🙂2.3KViews1like0CommentsRe: Defender 365 threat notifications and emailing teams channel
Hi Mike, have you tried doing so through power automate? You can set specific rule on email to trigger teams message in channel, try this one - https://powerautomate.microsoft.com/en-US/templates/details/04d1cbbd3e4f412d838fefccaad8058e/post-message-to-microsoft-teams-when-an-email-arrives-in-office-365-outlook/4KViews0likes1CommentRe: Different between Entity type 'File' and 'Machine'
Hi Zzhaoxi The alert evidence table (See documentation) has multiple rows per each alert, with all the different evidence, machine, files etc. In the alert you looked at, supposedly there should be more rows for the for the file entity. The problem might be that there's no definition for the join kind in your query, which will default to innerunique. Try this one: AlertEvidence |join kind=leftouter AlertInfo on AlertId |project Timestamp,Title,EntityType,FileName,FolderPath,AlertId,SHA1,SHA256,Category,AdditionalFields |where AdditionalFields contains "input PC name here"1.2KViews0likes3Comments