- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
09-18-2023 12:22 PM - edited 09-18-2023 12:22 PM
Dear community,
I've been evaluating the benefits of ingesting o365 logs so far. Seeking those who have the mentioned logs ingested into Cortex XDR -
does Cortex XDR review and raise alert using the hashes of the attachment if the attachment is a malware?
Besides, what are the useful data / alert that you think it helped your organization in terms of day-to-day operation/investigation?
Thank you
Cortex XDR
09-19-2023 01:26 AM
Hello @Antony_Chan
Thanks for reaching out on Live Community!
XDR collect following data from O365 emails.
All message details except the body
, bodyPreview
, and subject
.
Attachment details include file name, file type, file hash, size, and id.
Based on above data Cortex XDR raise alerts (Analytics, IOC, BIOC, and Correlation Rules). So if an attachment hash is listed under IOC/BIOC, XDR is going to raise an alert.
Regarding useful data/alerts, use case vary from organisation to organisation. XDR collects lot of data like Azure AD logs, exchange logs, DLP etc. Based on these logs you can build use cases. Please refer below documentation for details on ingesting Microsoft O365 logs.
09-19-2023 01:26 AM
Hello @Antony_Chan
Thanks for reaching out on Live Community!
XDR collect following data from O365 emails.
All message details except the body
, bodyPreview
, and subject
.
Attachment details include file name, file type, file hash, size, and id.
Based on above data Cortex XDR raise alerts (Analytics, IOC, BIOC, and Correlation Rules). So if an attachment hash is listed under IOC/BIOC, XDR is going to raise an alert.
Regarding useful data/alerts, use case vary from organisation to organisation. XDR collects lot of data like Azure AD logs, exchange logs, DLP etc. Based on these logs you can build use cases. Please refer below documentation for details on ingesting Microsoft O365 logs.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!