Microsoft Defender for Office 365
Email security — Microsoft
What is this product?
Email protection built into Microsoft 365. Every message lands in the `EmailEvents` table with its DeliveryAction and threat type, and it can remove a message that already arrived using ZAP.
About the company
Part of Microsoft 365 protection, working directly inside Exchange Online and sharing the KQL query language with Sentinel and Defender.
What does an analyst do inside it?
- Searches `EmailEvents` in KQL by sender or subject.
- Reads `DeliveryAction` to see whether the message was delivered or blocked.
- Removes the message from every mailbox once the threat is confirmed.
- Adds the sender to the block list.
Its search language
These examples are written in the syntax the product itself accepts.
- EmailEvents | where DeliveryAction == "Blocked"
- EmailEvents | where SenderFromAddress == "billing@example.com"
The field names it uses
- SenderFromAddress
- RecipientEmailAddress
- Subject
- DeliveryAction
- ThreatTypes
- SenderIPv4
Practise it now
Pick this product inside the simulator and the field names, search language, severity wording and response actions all switch to match how it works.
Open the simulatorWhere does it show up in the job market?
Used by every Microsoft 365 organisation, and the first place an analyst looks when someone reports a suspicious email.
Tools in the same category
The content is educational and follows the product's style. ShiftZero is not affiliated with the vendor and does not run its software.