What information does this report provide
The Threat Watch alert report provides a consolidated view of the statistics of all the impacted Microsoft 365 (Exchange Online, OneDrive, SharePoint) resources for which malicious data is found within a specified period.
How does the report help
You can leverage this report to get insights about:
Resource Name
Resource Type - OneDrive, Exchange Online, SharePoint
User Name - For OneDrive and Exchange Online
Number of Impacted Snapshots
IOC library
First Matched Snapshot
Last Matched Snapshot
With this report, you can proactively get insights into the list of impacted resources and take necessary actions such as isolate or quarantine the infected OneDrive or SharePoint resources.
To access the report
You need to be a Druva Cloud Administrator.
Go to Druva Cloud Platform Console Global Navigation > Reports > Cyber Resilience > Threat Watch Alert Report-Microsoft 365.
Using the report
📝 Note:
By default, the period selected for the report is 30 days from the current date. For example, if today is March 31, 2024, the report displays data from March 1 to March 30, 2024.
The data in the reports is synced periodically. The report shows the Data last updated details.
The Threat Watch Alert Report - Microsoft 365 comprises the following information:
Field | Description |
Resource Name | The name of the impacted resource. |
Resource Type | Type of impacted resource - OneDrive, Exchange Online, SharePoint. |
Number of Impacted Snapshots | The count of impacted snapshots found in the resource. |
First Matched Snapshot | The first snapshot details for which file matches were found. |
Last Matched Snapshot | The last snapshot details for which file matches were found. |
IOC library | The IOC details (File Hash or file extension) using which the scanning was performed. |
Actions
To leverage the report, you can perform the following actions:
Manage Reports: Learn how to subscribe to reports, apply filters, email reports, and edit existing subscriptions.
Custom Report Creation: Learn how to customize, and manage your own reports.