Hashes of the attachment from the o365 log

Antony_Chan — Mon, 18 Sep 2023 19:22:33 GMT

Dear community,

I've been evaluating the benefits of ingesting o365 logs so far. Seeking those who have the mentioned logs ingested into Cortex XDR -

does Cortex XDR review and raise alert using the hashes of the attachment if the attachment is a malware?

Besides, what are the useful data / alert that you think it helped your organization in terms of day-to-day operation/investigation?

Thank you

Re: Hashes of the attachment from the o365 log

nsinghvirk — Tue, 19 Sep 2023 08:26:49 GMT

Hello @Antony_Chan

Thanks for reaching out on Live Community!

XDR collect following data from O365 emails.

All message details except the body, bodyPreview, and subject.
Attachment details include file name, file type, file hash, size, and id.

Based on above data Cortex XDR raise alerts (Analytics, IOC, BIOC, and Correlation Rules). So if an attachment hash is listed under IOC/BIOC, XDR is going to raise an alert.

Regarding useful data/alerts, use case vary from organisation to organisation. XDR collects lot of data like Azure AD logs, exchange logs, DLP etc. Based on these logs you can build use cases. Please refer below documentation for details on ingesting Microsoft O365 logs.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Ingest-Logs-from-Microsoft-Office-365

topic Hashes of the attachment from the o365 log in Cortex XDR Discussions

Hashes of the attachment from the o365 log

Re: Hashes of the attachment from the o365 log