Microsoft Defender for Office: Introducing “Threat classification” for email

Microsoft Defender for Office is introducing a “Threat classification” feature for emails, utilizing advanced techniques for accurate threat intent analysis. It will integrate across various experiences, aiding in better detection and response. The rollout begins early January 2025 and completes by late January 2025. Users should prepare by familiarizing with the new feature and updating workflows. Coming soon to Microsoft Defender for Office: We will introduce Threat classification details to enhance your ability to understand the intent behind email attacks. This update will allow you to integrate Threat classification information across key experiences, enabling better detection, analysis, and response. The Threat classification system utilizes large language models (LLMs), machine learning (ML) models, and other advanced techniques to understand the intent behind threats, providing a more accurate classification. As the system evolves, you can expect new Threat classifications to be added to keep pace with emerging attack methods. When this will happen: General Availability (Worldwide): We will begin rolling out early January 2025 and expect to complete by late January 2025. How this will affect your organization: Threat Explorer: You will be able to filter emails by Threat classification, view the classification in the results, analyze trends using charts, and export data with the classification details included: View image in new tab Advanced Hunting: The ThreatClassification column will be available in the EmailEvents table, allowing you to create custom detection rules based on classification details: View image in new tab Email summary panel: Threat classification will be integrated across multiple areas, including Alerts, Incidents, Reports, AIR, Submission, Explorer, and Advanced Hunting, providing a comprehensive view of threat classifications: Email entity page: A new Threat classification field will be added in the threat detection details, helping you understand the context and intent of the detected threat: What you need to do to prepare: View image in new tab View image in new tab These changes will be available by default for admins to configure. Familiarize your team with the new Threat classification details available in the Threat Explorer, Advanced Hunting, email summary panel, and email entity page. Leverage Threat classification to enhance […]

The post Microsoft Defender for Office: Introducing “Threat classification” for email appeared first on M365 Admin.