Hashes of the attachment from the o365 log

[Antony_Chan]

Dear community,

I've been evaluating the benefits of ingesting o365 logs so far. Seeking those who have the mentioned logs ingested into Cortex XDR -

does Cortex XDR review and raise alert using the hashes of the attachment if the attachment is a malware?

Besides, what are the useful data / alert that you think it helped your organization in terms of day-to-day operation/investigation?

Thank you
Cortex XDR 

[nsinghvirk · Accepted solution]

Hello @Antony_Chan 

Thanks for reaching out on Live Community!

XDR collect following data from O365 emails.

• All message details except the body, bodyPreview, and subject.

• Attachment details include file name, file type, file hash, size, and id.

Based on above data Cortex XDR raise alerts (Analytics, IOC, BIOC, and Correlation Rules). So if an attachment hash is listed under IOC/BIOC, XDR is going to raise an alert.

Regarding useful data/alerts, use case vary from organisation to organisation. XDR collects lot of data like Azure AD logs, exchange logs, DLP etc. Based on these logs you can build use cases. Please refer below documentation for details on ingesting Microsoft O365 logs.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Ingest-Logs...