topic Re: Create IoC to detect email address from O365 log in Cortex XDR Discussions

Create IoC to detect email address from O365 log

FabioFerreira — Mon, 18 Sep 2023 15:45:48 GMT

Hi,

I am adding an email as a IOC in Cortex XDR, but it is not being detected through O365 logs.

Could you help?

O365 log

fieldname : "sender"

data: "{"emailAddress":{"name":"XXXX","address":"xxxx@xpto.com"}}"

Regards,

Re: Create IoC to detect email address from O365 log

nsinghvirk — Tue, 19 Sep 2023 09:42:20 GMT

Hello @FabioFerreira ,

Thanks for reaching out on Live Community!

Unfortunately XDR do not support to add email address as an IOC. You can add domains/URLs. If you want to get alerts based on the email address then please create correlation rule.