⚠️ Vaikora-O365

⚠️ Unpublished: This item is from a solution that is not yet published on Azure Marketplace or not installed in Content Hub.

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Solutions Index

Attribute	Value
Publisher	Data443 Risk Mitigation, Inc.
Support Tier	Partner
Support Link	https://www.data443.com
Categories	Security - Threat Protection
Version	3.0.0
Author	Data443 Risk Mitigation, Inc. - support@data443.com
First Published	2026-05-13
Solution Folder	Vaikora-O365

The Vaikora for O365 solution ships the Microsoft Sentinel content that pairs with the Vaikora-O365 black-box Azure VM. The VM scans Microsoft 365 mailboxes via Microsoft Graph API, classifies messages with the CTASD inference engine, and writes quarantine events into a custom Log Analytics table (VaikoraO365_Quarantine_CL). This solution adds a Logic App playbook that turns each quarantine event into a Microsoft Sentinel incident, plus analytic rules over the custom table that fire on high-confidence phishing scores and tenant-wide quarantine rate anomalies.

Data Connectors
Tables Used
Content Items

Data Connectors

This solution does not include data connectors.

This solution may contain other components such as analytics rules, workbooks, hunting queries, or playbooks.

Tables Used

This solution queries 1 table(s) from its content items:

Table	Used By Content
`VaikoraO365_Quarantine_CL`	Analytics, Workbooks

Content Items

This solution includes 5 content item(s):

Content Type	Count
Analytic Rules	3
Workbooks	1
Playbooks	1

Analytic Rules

Name	Severity	Tactics	Tables Used
Vaikora - Engine offline	Medium	DefenseEvasion	`VaikoraO365_Quarantine_CL`
Vaikora - High score quarantine	High	InitialAccess, CredentialAccess, Collection, Exfiltration	`VaikoraO365_Quarantine_CL`
Vaikora - Quarantine rate spike	Medium	InitialAccess	`VaikoraO365_Quarantine_CL`

Workbooks

Name	Tables Used
VaikoraO365QuarantineDashboard	`VaikoraO365_Quarantine_CL`

Playbooks

Name	Description	Tables Used
Vaikora for O365 - Quarantine Incident Responder	This playbook responds to Microsoft Sentinel incidents raised from the VaikoraO365_Quarantine_CL cus...	-

Release Notes

Version	Date Modified (DD-MM-YYYY)	Change History
3.0.0	13-05-2026	Initial release. Vaikora for O365 quarantine solution pairing the customer-tenant Vaikora-O365 black-box Azure VM with Microsoft Sentinel. Ships one Sentinel-incident-triggered playbook (VaikoraO365ToQuarantine) and three analytic rules over the VaikoraO365_Quarantine_CL custom Log Analytics table: high-confidence phishing/suspected quarantine, abnormal quarantine rate spikes, and engine offline detection.