Automated Remediation Manual versus Automatic Approval

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

This query shows whether Microsoft Defender for Office 365 automated remediation actions were taken automatically or required manual admin approval, using the EmailPostDeliveryEvents table.

Attribute	Value
Type	Hunting Query
Solution	Microsoft Defender XDR
ID	2a3fe5b0-9a99-467a-b5f9-57825530b22b
Tactics	InitialAccess
Techniques	T1566
Required Connectors	MicrosoftThreatProtection
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
EmailPostDeliveryEvents	✓	✗	✓

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries · Back to Microsoft Defender XDR