Microsoft 365 Defender Classification

Microsoft 365 Defender singleSelect

Details

IDincident_microsoft365defenderclassification
CLI Namemicrosoft365defenderclassification
TypesingleSelect
Version-1
RequiredNo
Read OnlyNo
Use as KPINo
SearchableYes

Select Values

  • TruePositive - MultiStagedAttack
  • TruePositive - MaliciousUserActivity
  • TruePositive - Malware
  • TruePositive - Phishing
  • TruePositive - CompromisedAccount
  • TruePositive - UnwantedSoftware
  • TruePositive - Other
  • InformationalExpectedActivity - SecurityTesting
  • InformationalExpectedActivity - LineOfBusinessApplication
  • InformationalExpectedActivity - ConfirmedActivity
  • InformationalExpectedActivity - Other
  • FalsePositive - NotMalicious
  • FalsePositive - NoEnoughDataToValidate
  • FalsePositive - Other
  • Unknown - NotAvailable

Associated Incident Types