52595 – Improvements to Threat Explorer for better hunting experience (archived)

Product:

Advanced Threat Protection - Azure (ATP), Advanced Threat Protection - Office 365, Enterprise Mobility + Security, Exchange, Information Protection, Microsoft 365 admin center, Microsoft Information Protection, Purview Information Protection

Platform:

World tenant

Status:

Launched

Change type:

Links:

Details:

We're making significant improvements to the Threat Explorer for better manual threat hunting experience. Based on common hunting scenarios and customer feedback, we're introducing following updates:      1. Clarity on delivery status of an email :      Today in Explorer/ Real-time detections, we show the delivery status of an email which could be delivered, delivered to junk, blocked, replaced and removed by ZAP. The status doesn’t help paint a complete picture of where the email actually landed and where is it at a given point of time.      We're going to split the existing delivery status into more accurate values and simpler relatable names to define it. Delivery status is renamed to “Delivery action” and “Delivery location” is another column which is added to indicate the location of an email. There might be events which occur post-delivery of an email, they are captured under the column “Special action”. All these values combined would help the admin understand what action(s) were taken on an email and the location of that email.           2. Timeline view for an email:      Email timeline is a new feature underway to make hunting simpler for admins. In case of multiple events occurring on the same email, that would be shown in a timeline view so the admin won't have to hunt down at different places to understand the email events.           3. Ability for admins to view and download malicious emails for analysis:      Email preview and download option will allow the admins to better analyze bad emails      We'll be rolling out these features in the order above.

Change Category:
XXXXXXX ...

Scope:
XXXXXXX ...

Release Phase:
General Availability

Created:
2019-06-26

updated:
2020-01-14