Microsoft has updated its Defender for Office 365 workbook in Microsoft Sentinel, adding 12 tabs with new visuals and insights for enhanced email security reporting. The customizable workbook helps security teams track threats, false positives, quarantines, and user behaviors, improving threat detection and response. Unique :

Unlock Powerful Email Security Insights with Microsoft Sentinel Workbooks

If you’re deep into email security, you know the value of tailored reports. Microsoft just dropped a major update to the Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel. This tool helps security pros track key metrics, spot trends, and make smarter decisions faster.

What’s New in the Latest Workbook Update?

Microsoft revamped the workbook structure for smoother navigation. Now, related visuals and insights live on their own dedicated tabs. This change means less clutter and faster access to what matters most.

• New tabs for False Positive and False Negative submissions
• Added a fresh Quarantine Insights tab
• Total of 12 tabs covering everything from malware detections to admin actions

As Microsoft puts it,

“We have incorporated user feedback to enhance the experience for all users.”

This update is all about making life easier for security teams.

Major Updates and Fresh Visuals

The workbook now includes new insights that sharpen your view of email threats. For example:

• Detection Overview: Track bad traffic percentage of inbound emails daily.
• Email Malware/Phish Tabs: Visualize zero-day detections using URL and attachment detonation.
• Phish Detection: See top outbound domains linked to inbound threats, helping catch partner BEC attacks.
• URL Detections: Identify the most clicked malicious URLs by users.

Plus, existing visuals got a makeover with searchable grids and extra data points. For instance, the top 10 malware-sending domains now show total emails sent and bad traffic percentages.

Why Use Microsoft Sentinel Workbooks for Email Security?

If you’re already using Microsoft Sentinel, workbooks are a no-brainer. They offer:

• Longer data retention for trend analysis over months or even a year
• Auto-refresh to keep your dashboards current
• Ready-to-use templates that you can customize with simple clicks or KQL tweaks

Microsoft highlights,

“You can customize each visual easily or review the underlying KQL.”

This flexibility means you can tailor reports to your team’s exact needs.

Getting Started and Sharing Insights

The updated workbook is part of the Microsoft Defender XDR solution, version 3.0.1 If you have it deployed, just update to get the new template. New users get it out-of-the-box.

Sharing dashboards with leadership is easy, too. Microsoft Sentinel supports role-based access control (RBAC), so you can grant access without exposing everything.

Final Thoughts

Custom email security reporting just got a serious upgrade. Whether you’re hunting threats or reporting to execs, these workbooks make your data more actionable. Dive in, customize, and stay ahead of evolving email threats.

The workbook now features separate tabs for False Positive and False Negative submissions to streamline analysis.

New visuals include detection overviews highlighting bad traffic percentages and zero-day malware/phish detections.

Top malicious URLs clicked and quarantine insights tabs help identify risky user behavior and email filtering effectiveness.

Searchable grid views improve investigation of malware families and email senders across multiple Microsoft 365 services.

Users can easily customize visuals and queries within the workbook to tailor reports to organizational needs.

From the New blog articles in Microsoft Community Hub

---