Create IoC to detect email address from O365 log

[FabioFerreira]

Hi,

I am adding an email as a IOC in Cortex XDR, but it is not being detected through O365 logs.

Could you help?

O365 log

fieldname : "sender"

data: "{"emailAddress":{"name":"XXXX","address":"xxxx@xpto.com"}}"

Regards,

[nsinghvirk · Accepted solution]

Hello @FabioFerreira ,

Thanks for reaching out on Live Community!

Unfortunately XDR do not support to add email address as an IOC. You can add domains/URLs. If you want to get alerts based on the email address then please create correlation rule.