From 830f8f9d51788a61a460fe967f8af8ddb43b58b2 Mon Sep 17 00:00:00 2001 From: Chris Davis Date: Wed, 15 Jan 2025 15:54:04 -0800 Subject: [PATCH 1/2] Update threat-explorer-real-time-detections-about.md Threat classification --- ...eat-explorer-real-time-detections-about.md | 27 ++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/defender-office-365/threat-explorer-real-time-detections-about.md b/defender-office-365/threat-explorer-real-time-detections-about.md index e1077714f3..93637eba87 100644 --- a/defender-office-365/threat-explorer-real-time-detections-about.md +++ b/defender-office-365/threat-explorer-real-time-detections-about.md @@ -7,7 +7,7 @@ author: chrisda manager: deniseb audience: ITPro ms.topic: conceptual -ms.date: 10/07/2024 +ms.date: 01/15/2025 ms.localizationpriority: medium ms.collection: - m365-security @@ -181,6 +181,7 @@ The filterable properties that are available in the **Delivery action** box in t |Additional action|Select one or more values: | |Directionality|Select one or more values: | |Detection technology|Select one or more values: | +|Threat classification|Select one or more values: For more information, see [Threat classification in Microsoft Defender for Office 365](mdo-threat-classification.md).| |Original delivery location|Select one or more values: | |Latest delivery location¹|Same values as **Original delivery location**| |Phish confidence level|Select one or more values: | @@ -279,6 +280,12 @@ The **Detection technology** pivot organizes the chart by the feature that ident Hovering over a data point in the chart shows the count for each detection technology. +#### Threat classification chart pivot in the All email view in Threat Explorer + +The **Threat classification** pivot organizes the chart by classified threats. For more information, see [Threat classification in Microsoft Defender for Office 365](mdo-threat-classification.md). + +Hovering over a data point in the chart shows the count for each classification. + #### Full URL chart pivot in the All email view in Threat Explorer The **Full URL** pivot organizes the chart by the full URLs in messages for the specified date/time range and property filters. @@ -340,6 +347,7 @@ The **Email** view shows a details table. You can sort the entries by clicking o - **Data loss prevention rule** - **Threat type**\* - **Detection technology** +- **Threat classification** - **Attachment Count** - **URL Count** - **Email size** @@ -681,6 +689,7 @@ The chart pivots that are available in the **Malware** view in Threat Explorer a |**Sender domain**|✔|| |**Sender IP**|✔|| |**Delivery action**|✔|✔| +|**Threat classification**|✔|✔| |**Detection technology**|✔|✔| The available chart pivots are described in the following subsections. @@ -721,6 +730,12 @@ The **Delivery action** pivot organizes the chart by what happened to messages t Hovering over a data point in the chart shows the count for each delivery action. +#### Threat classification chart pivot in the Malware view in Threat Explorer and Real-time detections + +The **Threat classification** pivot organizes the chart by classified threats. For more information, see [Threat classification in Microsoft Defender for Office 365](mdo-threat-classification.md). + +Hovering over a data point in the chart shows the count for each classification. + #### Detection technology chart pivot in the Malware view in Threat Explorer and Real-time detections The **Detection technology** pivot organizes the chart by the feature that identified malware in messages for the specified date/time range and property filters. @@ -778,6 +793,7 @@ The following table shows the columns that are available in Threat Explorer and |**Data loss prevention rule**|✔|✔| |**Threat type**\*|✔|✔| |**Detection technology**|✔|✔| +|**Threat classification**|✔|✔| |**Attachment Count**|✔|✔| |**URL Count**|✔|✔| |**Email size**|✔|✔| @@ -895,6 +911,7 @@ The filterable properties that are available in the **Sender address** box in th |Additional action|Select one or more values: |✔|✔| |Directionality|Select one or more values: |✔|✔| |Detection technology|Select one or more values: |✔|✔| +|Threat classification|Select one or more values: For more information, see [Threat classification in Microsoft Defender for Office 365](mdo-threat-classification.md).| |Original delivery location|Select one or more values: |✔|✔| |Latest delivery location|Same values as **Original delivery location**|✔|✔| |Phish confidence level|Select one or more values: |✔|| @@ -947,6 +964,7 @@ The chart pivots that are available in the **Phish** view in Threat Explorer and |**Sender IP**|✔|| |**Delivery action**|✔|✔| |**Detection technology**|✔|✔| +|**Threat classification**|✔|✔| |**Full URL**|✔|| |**URL domain**|✔|✔| |**URL domain and path**|✔|| @@ -989,6 +1007,12 @@ The **Detection technology** pivot organizes the chart by the feature that ident Hovering over a data point in the chart shows the count for each detection technology. +#### Threat classification chart pivot in the Phish view in Threat Explorer and Real-time detections + +The **Threat classification** pivot organizes the chart by classified threats. For more information, see [Threat classification in Microsoft Defender for Office 365](mdo-threat-classification.md). + +Hovering over a data point in the chart shows the count for each classification. + #### Full URL chart pivot in the Phish view in Threat Explorer The **Full URL** pivot organizes the chart by the full URLs in phishing messages for the specified date/time range and property filters. @@ -1065,6 +1089,7 @@ The following table shows the columns that are available in Threat Explorer and |**Data loss prevention rule**|✔|| |**Threat type**\*|✔|✔| |**Detection technology**|✔|✔| +|**Threat classification**|✔|✔| |**Attachment Count**|✔|✔| |**URL Count**|✔|✔| |**Email size**|✔|✔| From 06c1ff11a90059d418982ebbeffb8b5cdd35734f Mon Sep 17 00:00:00 2001 From: Chris Davis Date: Wed, 15 Jan 2025 15:56:11 -0800 Subject: [PATCH 2/2] Update threat-explorer-real-time-detections-about.md --- .../threat-explorer-real-time-detections-about.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defender-office-365/threat-explorer-real-time-detections-about.md b/defender-office-365/threat-explorer-real-time-detections-about.md index 93637eba87..c5f0998e6e 100644 --- a/defender-office-365/threat-explorer-real-time-detections-about.md +++ b/defender-office-365/threat-explorer-real-time-detections-about.md @@ -911,7 +911,7 @@ The filterable properties that are available in the **Sender address** box in th |Additional action|Select one or more values: |✔|✔| |Directionality|Select one or more values: |✔|✔| |Detection technology|Select one or more values: |✔|✔| -|Threat classification|Select one or more values: For more information, see [Threat classification in Microsoft Defender for Office 365](mdo-threat-classification.md).| +|Threat classification|Select one or more values: For more information, see [Threat classification in Microsoft Defender for Office 365](mdo-threat-classification.md).|✔|✔| |Original delivery location|Select one or more values: |✔|✔| |Latest delivery location|Same values as **Original delivery location**|✔|✔| |Phish confidence level|Select one or more values: |✔||