O365 Defender SafeLinks

Provides URL scanning and rewriting of inbound email messages in mail flow, and time-of-click verification of URLs and links in email messages and other locations.
This integration was integrated and tested with Exchange Online PowerShell V2 module, and Defender for Office 365.

The Safe Links Product overview

Required Permissions

• In the Azure Application, give the following application permission:
  • Office 365 Exchange Online -> Exchange.ManageAsApp - Application
• To create, modify, and delete Safe Links policies, or use any of the report commands (detailed or aggregate report), you need to be a member of the Organization Management or Security Administrator role groups.
• To manage permissions in the Microsoft Defender XDR portal, go to Permissions & roles or https://security.microsoft.com/securitypermissions. You need to be a global administrator or a member of the Organization Management role group in the Microsoft Defender XDR portal. Specifically, the Role Management role allows users to view, create, and modify role groups in the Microsoft Defender XDR portal, and by default, that role is assigned only to the Organization Management role group. See Permissions in the Microsoft Defender XDR portal

Configure O365 Defender SafeLinks in Cortex

Safe Links Rule and Policy

The basic elements of a Safe Links policy are:

The safe links policy: Turn on Safe Links protection, turn on real-time URL scanning, specify whether to wait for real-time scanning to complete before delivering the message, turn on scanning for internal messages, specify whether to track user clicks on URLs, and specify whether to allow users to click trough to the original URL.
The safe links rule: Specifies the priority and recipient filters (who the policy applies to).
The difference between these two elements isn’t obvious when you manage Safe Links policies in the Microsoft Defender XDR portal:

When you create a Safe Links policy, you’re actually creating a safe links rule and the associated safe links policy at the same time using the same name for both.
When you modify a Safe Links policy, settings related to the name, priority, enabled or disabled, and recipient filters modify the safe links rule. All other settings modify the associated safe links policy.
When you remove a Safe Links policy, the safe links rule and the associated safe links policy are removed.
In Exchange Online PowerShell or standalone EOP PowerShell, you manage the policy and the rule separately.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

o365-defender-safelinks-policy-list

List the Safe Links policies in your cloud-based organization.

Base Command

o365-defender-safelinks-policy-list

Input

Context Output

Command Example

#### Context Example

```json
{
  "O365Defender.SafeLinks.Policy(obj.Guid === val.Guid)": [
    {
      "AdminDisplayName": "Few URL",
      "AllowClickThrough": true,
      "CustomNotificationText": "Sorry, you cant click through this URL",
      "DeliverMessageAfterScan": false,
      "DisableUrlRewrite": false,
      "DistinguishedName": "CN=XSOAR Policy,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=xsoartest.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR07A123,DC=PROD,DC=OUTLOOK,DC=COM",
      "DoNotAllowClickThrough": false,
      "DoNotRewriteUrls": [
        "www.test.com",
        "https://xsoar.test.com"
      ],
      "DoNotTrackUserClicks": false,
      "EnableForInternalSenders": false,
      "EnableOrganizationBranding": false,
      "EnableSafeLinksForTeams": false,
      "ExchangeObjectId": "5796cea3-cfdb-4a99-9956-bf62209118a6",
      "ExchangeVersion": "0.20 (15.0.0.0)",
      "ExcludedUrls": [
        "www.test.com",
        "https://xsoar.test.com"
      ],
      "Guid": "5796cea3-cfdb-4a99-9956-bf62209118a6",
      "Id": "XSOAR Policy",
      "Identity": "XSOAR Policy",
      "IsBuiltInProtection": false,
      "IsDefault": false,
      "IsEnabled": true,
      "IsValid": true,
      "LocalizedNotificationTextList": [
        "[zh-Hant, 對不起，你不能點擊通過這個網址]",
        "[af, Jammer, jy kan nie deur hierdie URL klik nie]",
        "[hi, क्षमा करें, आप इस यूआरएल के माध्यम से क्लिक नहीं कर सकते]",
        "[ja, この URL をクリックできません。]",
        "[otq, Nä'ä di tsa̲hu̲, hingi tsa̲ o̲t'e clic nuna ar URL]",
        "[zh-Hans, 对不起，你不能点击通过这个网址]",
        "[ur, معذرت، آپ اس یو آر ایل کے ذریعے کلک نہیں کر سکتے]",
        "[ht, Padon, ou pa klike sou URL sa a]",
        "[it, Siamo spiacenti, non puoi fare clic su questo URL]",
        "[ms, Maaf, anda tidak boleh klik melalui URL ini]",
        "[bs, Žao mi je, ne možete kliknuti kroz ovaj URL]",
        "[cs, Je nám líto, ale nemůžete kliknout na tuto adresu URL]",
        "[mt, Jiddispjaċina, ma tistax tikklikkja permezz ta' dan il-URL]",
        "[fa, با عرض پوزش، شما نمی توانید از طریق این آدرس کلیک کنید]",
        "[ga, Ár leithscéal, ní féidir leat cliceáil tríd an URL seo]",
        "[da, Beklager, men du kan ikke klikke dig igennem denne URL-adresse]",
        "[hr, Nažalost, ne možete kliknuti kroz ovaj URL]",
        "[he, מצטערים, אתה לא יכול ללחוץ על כתובת URL זו]",
        "[et, Kahjuks ei saa te seda URL-i klõpsata]",
        "[tr, Üzgünüz, bu URL'yi tıklatamazsınız]",
        "[ru, Извините, вы не можете щелкнуть по этому URL-адресу]",
        "[nb, Beklager, du kan ikke klikke deg gjennom denne URL-adressen]",
        "[ar, عذرا، أنت غير قادر على النقر من خلال هذا العنوان]",
        "[fr, Désolé, vous ne pouvez pas cliquer sur cette URL]",
        "[sv, Tyvärr kan du inte klicka igenom den här URL:en]",
        "[tlh-Piqd,      ]",
        "[de, Es tut uns leid, aber Sie können sich nicht durch diese URL klicken]",
        "[id, Maaf, Anda tidak bisa mengklik URL ini]",
        "[kk, Кешіріңіз, осы URL мекенжайы арқылы басуға болмайды]",
        "[lv, Atvainojiet, jūs nevarat noklikšķināt caur šo URL]",
        "[yue, 对唔住，你唔可以點擊透過呢個網址]",
        "[nl, Sorry, u kunt niet door deze URL klikken]",
        "[ro, Ne pare rău, tu cant faceți clic prin acest URL-ul]",
        "[ml, ക്ഷമിക്കണം, ഈ യുആർഎൽ വഴി ക്ലിക്ക് ചെയ്യാൻ നിങ്ങൾക്ക് കഴിയില്ല]",
        "[sw, Samahani, unaweza kubofya kupitia URL hii]",
        "[sl, Žal ne morete klikati preko tega URL-ja]",
        "[th, ขออภัย คุณไม่สามารถคลิกผ่าน URL นี้]",
        "[to, Kātaki fakamolemole, he ʻikai lava ke ke lomiʻi ʻi he URL ko ʻení]",
        "[pt-PT, Desculpe, não pode clicar neste URL]",
        "[ca, Ho sentim, no podeu fer clic a través d'aquesta URL]",
        "[ko, 죄송합니다, 이 URL을 클릭할 수 없습니다.]",
        "[el, Δυστυχώς, δεν μπορείτε να κάνετε κλικ σε αυτήν τη διεύθυνση URL]",
        "[fil, Paumanhin, maaari mong i-click sa pamamagitan ng URL na ito]",
        "[fj, Vosota, e sega ni rawa ni o kiliki ena URL oqo]",
        "[cy, Mae'n ddrwg gennym, gallwch glicio drwy'r URL hwn]",
        "[hu, Sajnáljuk, nem kattinthat át ezen az URL-címen]",
        "[pt, Desculpe, você não pode clicar através desta URL]",
        "[kn, ಕ್ಷಮಿಸಿ, ಈ ಯುಆರ್ ಎಲ್ ಮೂಲಕ ನೀವು ಕ್ಲಿಕ್ ಮಾಡಲು ಸಾಧ್ಯವಿಲ್ಲ]",
        "[pl, Przepraszamy, nie możesz kliknąć tego adresu URL]",
        "[bn, দুঃখিত, আপনি এই ইউআরএল-এর মাধ্যমে ক্লিক করতে পারবেন না]",
        "[vi, Xin lỗi, bạn không thể nhấp qua URL này]",
        "[gu, માફ કરશો, તમે આ યુઆરએલ દ્વારા ક્લિક કરી શકતા નથી]",
        "[sr-Cyrl, Жао нам је, не можете кликнути кроз ову УРЛ адресу]",
        "[sr-Latn, Žao nam je, ne možete kliknuti kroz ovu URL adresu]",
        "[sk, Ľutujeme, nemôžete kliknúť na túto adresu URL]",
        "[en, Sorry, you cant click through this URL]",
        "[uk, На жаль, ви нахиляє натисніть через цю URL-адресу]",
        "[mi, Aroha mai, kāore e taea te pāwhiri mā tēnei URL]",
        "[sm, Faamalie atu, e le mafai ona e kiliki i le URL lenei]",
        "[fi, Valitettavasti et voi napsauttaa tätä URL-osoitetta]",
        "[lt, Atsiprašome, jūs negalite spustelėti per šį URL]",
        "[bg, Съжаляваме, можете да кликнете чрез този URL адрес]",
        "[te, క్షమించండి, ఈ యుఆర్ ఎల్ ద్వారా మీరు క్లిక్ చేయలేరు]",
        "[is, Því miður geturðu ekki smellt í gegnum þessa slóð]",
        "[ta, மன்னிக்கவும், இந்த யுஆர்எல் வழியாக கிளிக் செய்ய முடியாது]",
        "[tlh-Latn, taHqeq mIv'a' tIqwIj, qaStaHvIS poH nI''e']",
        "[mww, Thov txim, koj yuav nias los ntawm no URL]",
        "[es, Lo sentimos, no puedes hacer clic en esta URL]",
        "[pa, ਮਾਫ਼ ਕਰਨਾ, ਤੁਸੀਂ ਇਸ ਯੂਆਰਐਲ ਰਾਹੀਂ ਕਲਿੱਕ ਨਹੀਂ ਕਰ ਸਕਦੇ]",
        "[mg, Miala tsiny fa tsy afaka manindry ity URL ity ianao]"
      ],
      "Name": "XSOAR Policy",
      "ObjectCategory": "EURPR07A123.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config",
      "ObjectClass": [
        "top",
        "msExchSmartLinksProtectionConfig"
      ],
      "ObjectState": "Unchanged",
      "OrganizationId": "EURPR07A123.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/xsoartest.onmicrosoft.com - EURPR07A123.PROD.OUTLOOK.COM/ConfigurationUnits/xsoartest.onmicrosoft.com/Configuration",
      "OrganizationalUnitRoot": "xsoartest.onmicrosoft.com",
      "OriginatingServer": "AM7PR07A05DC123.EURPR07A123.PROD.OUTLOOK.COM",
      "PSComputerName": "outlook.office365.com",
      "PSShowComputerName": false,
      "RecommendedPolicyType": "Custom",
      "RunspaceId": "8501abb8-6d7c-45ca-bc0d-4c260d68d248",
      "ScanUrls": false,
      "TrackClicks": true,
      "WhenChanged": "2021-10-21T12:49:09+00:00",
      "WhenChangedUTC": "2021-10-21T12:49:09Z",
      "WhenCreated": "2021-10-21T12:49:03+00:00",
      "WhenCreatedUTC": "2021-10-21T12:49:03Z",
      "WhiteListedUrls": "www.test.com,https://xsoar.test.com"
    }
  ]
}

Human Readable Output

Results of o365-defender-safelinks-policy-list

AdminDisplayName	AllowClickThrough	CustomNotificationText	DeliverMessageAfterScan	DisableUrlRewrite	DistinguishedName	DoNotAllowClickThrough	DoNotRewriteUrls	DoNotTrackUserClicks	EnableForInternalSenders	EnableOrganizationBranding	EnableSafeLinksForTeams	ExchangeObjectId	ExchangeVersion	ExcludedUrls	Guid	Id	Identity	IsBuiltInProtection	IsDefault	IsEnabled	IsValid	LocalizedNotificationTextList	Name	ObjectCategory	ObjectClass	ObjectState	OrganizationalUnitRoot	OrganizationId	OriginatingServer	PSComputerName	PSShowComputerName	RecommendedPolicyType	RunspaceId	ScanUrls	TrackClicks	WhenChanged	WhenChangedUTC	WhenCreated	WhenCreatedUTC	WhiteListedUrls
Few URL	true	Sorry, you cant click through this URL	false	false	CN=XSOAR Policy,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=xsoartest.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR07A123,DC=PROD,DC=OUTLOOK,DC=COM	false	[“www.test.com”,”https://xsoar.test.com”]	false	false	false	false	{“value”:”5796cea3-cfdb-4a99-9956-bf62209118a6”,”Guid”:”5796cea3-cfdb-4a99-9956-bf62209118a6”}	0.20 (15.0.0.0)	[“www.test.com”,”https://xsoar.test.com”]	{“value”:”5796cea3-cfdb-4a99-9956-bf62209118a6”,”Guid”:”5796cea3-cfdb-4a99-9956-bf62209118a6”}	XSOAR Policy	XSOAR Policy	false	false	true	true	[“[zh-Hant, 對不起，你不能點擊通過這個網址]”,”[af, Jammer, jy kan nie deur hierdie URL klik nie]”,”[hi, क्षमा करें, आप इस यूआरएल के माध्यम से क्लिक नहीं कर सकते]”,”[ja, この URL をクリックできません。]”,”[otq, Nä’ä di tsa̲hu̲, hingi tsa̲ o̲t’e clic nuna ar URL]”,”[zh-Hans, 对不起，你不能点击通过这个网址]”,”[ur, معذرت، آپ اس یو آر ایل کے ذریعے کلک نہیں کر سکتے]”,”[ht, Padon, ou pa klike sou URL sa a]”,”[it, Siamo spiacenti, non puoi fare clic su questo URL]”,”[ms, Maaf, anda tidak boleh klik melalui URL ini]”,”[bs, Žao mi je, ne možete kliknuti kroz ovaj URL]”,”[cs, Je nám líto, ale nemůžete kliknout na tuto adresu URL]”,”[mt, Jiddispjaċina, ma tistax tikklikkja permezz ta’ dan il-URL]”,”[fa, با عرض پوزش، شما نمی توانید از طریق این آدرس کلیک کنید]”,”[ga, Ár leithscéal, ní féidir leat cliceáil tríd an URL seo]”,”[da, Beklager, men du kan ikke klikke dig igennem denne URL-adresse]”,”[hr, Nažalost, ne možete kliknuti kroz ovaj URL]”,”[he, מצטערים, אתה לא יכול ללחוץ על כתובת URL זו]”,”[et, Kahjuks ei saa te seda URL-i klõpsata]”,”[tr, Üzgünüz, bu URL’yi tıklatamazsınız]”,”[ru, Извините, вы не можете щелкнуть по этому URL-адресу]”,”[nb, Beklager, du kan ikke klikke deg gjennom denne URL-adressen]”,”[ar, عذرا، أنت غير قادر على النقر من خلال هذا العنوان]”,”[fr, Désolé, vous ne pouvez pas cliquer sur cette URL]”,”[sv, Tyvärr kan du inte klicka igenom den här URL:en]”,”[tlh-Piqd,      ]”,”[de, Es tut uns leid, aber Sie können sich nicht durch diese URL klicken]”,”[id, Maaf, Anda tidak bisa mengklik URL ini]”,”[kk, Кешіріңіз, осы URL мекенжайы арқылы басуға болмайды]”,”[lv, Atvainojiet, jūs nevarat noklikšķināt caur šo URL]”,”[yue, 对唔住，你唔可以點擊透過呢個網址]”,”[nl, Sorry, u kunt niet door deze URL klikken]”,”[ro, Ne pare rău, tu cant faceți clic prin acest URL-ul]”,”[ml, ക്ഷമിക്കണം, ഈ യുആർഎൽ വഴി ക്ലിക്ക് ചെയ്യാൻ നിങ്ങൾക്ക് കഴിയില്ല]”,”[sw, Samahani, unaweza kubofya kupitia URL hii]”,”[sl, Žal ne morete klikati preko tega URL-ja]”,”[th, ขออภัย คุณไม่สามารถคลิกผ่าน URL นี้]”,”[to, Kātaki fakamolemole, he ʻikai lava ke ke lomiʻi ʻi he URL ko ʻení]”,”[pt-PT, Desculpe, não pode clicar neste URL]”,”[ca, Ho sentim, no podeu fer clic a través d’aquesta URL]”,”[ko, 죄송합니다, 이 URL을 클릭할 수 없습니다.]”,”[el, Δυστυχώς, δεν μπορείτε να κάνετε κλικ σε αυτήν τη διεύθυνση URL]”,”[fil, Paumanhin, maaari mong i-click sa pamamagitan ng URL na ito]”,”[fj, Vosota, e sega ni rawa ni o kiliki ena URL oqo]”,”[cy, Mae’n ddrwg gennym, gallwch glicio drwy’r URL hwn]”,”[hu, Sajnáljuk, nem kattinthat át ezen az URL-címen]”,”[pt, Desculpe, você não pode clicar através desta URL]”,”[kn, ಕ್ಷಮಿಸಿ, ಈ ಯುಆರ್ ಎಲ್ ಮೂಲಕ ನೀವು ಕ್ಲಿಕ್ ಮಾಡಲು ಸಾಧ್ಯವಿಲ್ಲ]”,”[pl, Przepraszamy, nie możesz kliknąć tego adresu URL]”,”[bn, দুঃখিত, আপনি এই ইউআরএল-এর মাধ্যমে ক্লিক করতে পারবেন না]”,”[vi, Xin lỗi, bạn không thể nhấp qua URL này]”,”[gu, માફ કરશો, તમે આ યુઆરએલ દ્વારા ક્લિક કરી શકતા નથી]”,”[sr-Cyrl, Жао нам је, не можете кликнути кроз ову УРЛ адресу]”,”[sr-Latn, Žao nam je, ne možete kliknuti kroz ovu URL adresu]”,”[sk, Ľutujeme, nemôžete kliknúť na túto adresu URL]”,”[en, Sorry, you cant click through this URL]”,”[uk, На жаль, ви нахиляє натисніть через цю URL-адресу]”,”[mi, Aroha mai, kāore e taea te pāwhiri mā tēnei URL]”,”[sm, Faamalie atu, e le mafai ona e kiliki i le URL lenei]”,”[fi, Valitettavasti et voi napsauttaa tätä URL-osoitetta]”,”[lt, Atsiprašome, jūs negalite spustelėti per šį URL]”,”[bg, Съжаляваме, можете да кликнете чрез този URL адрес]”,”[te, క్షమించండి, ఈ యుఆర్ ఎల్ ద్వారా మీరు క్లిక్ చేయలేరు]”,”[is, Því miður geturðu ekki smellt í gegnum þessa slóð]”,”[ta, மன்னிக்கவும், இந்த யுஆர்எல் வழியாக கிளிக் செய்ய முடியாது]”,”[tlh-Latn, taHqeq mIv’a’ tIqwIj, qaStaHvIS poH nI’‘e’]”,”[mww, Thov txim, koj yuav nias los ntawm no URL]”,”[es, Lo sentimos, no puedes hacer clic en esta URL]”,”[pa, ਮਾਫ਼ ਕਰਨਾ, ਤੁਸੀਂ ਇਸ ਯੂਆਰਐਲ ਰਾਹੀਂ ਕਲਿੱਕ ਨਹੀਂ ਕਰ ਸਕਦੇ]”,”[mg, Miala tsiny fa tsy afaka manindry ity URL ity ianao]”]	XSOAR Policy	EURPR07A123.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config	[“top”,”msExchSmartLinksProtectionConfig”]	Unchanged	xsoartest.onmicrosoft.com	EURPR07A123.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/xsoartest.onmicrosoft.com - EURPR07A123.PROD.OUTLOOK.COM/ConfigurationUnits/xsoartest.onmicrosoft.com/Configuration	AM7PR07A05DC123.EURPR07A123.PROD.OUTLOOK.COM	outlook.office365.com	false	Custom	{“value”:”8501abb8-6d7c-45ca-bc0d-4c260d68d248”,”Guid”:”8501abb8-6d7c-45ca-bc0d-4c260d68d248”}	false	true	{“value”:”2021-10-21T12:49:09+00:00”,”DateTime”:”Thursday, October 21, 2021 12:49:09 PM”}	{“value”:”2021-10-21T12:49:09Z”,”DateTime”:”Thursday, October 21, 2021 12:49:09 PM”}	{“value”:”2021-10-21T12:49:03+00:00”,”DateTime”:”Thursday, October 21, 2021 12:49:03 PM”}	{“value”:”2021-10-21T12:49:03Z”,”DateTime”:”Thursday, October 21, 2021 12:49:03 PM”}	www.test.com,https://xsoar.test.com

o365-defender-safelinks-policy-create

Create a new Safe Links policy.

Base Command

o365-defender-safelinks-policy-create

Input

Context Output

Command Example

o365-defender-safelinks-policy-create name=xsoartest admin_display_name="Description for policy" do_not_allow_click_through=true

Context Example

{
  "O365Defender.SafeLinks.Policy(obj.Guid === val.Guid)": [
    {
      "AdminDisplayName": "Few URL",
      "AllowClickThrough": true,
      "CustomNotificationText": "Sorry, you cant click through this URL",
      "DeliverMessageAfterScan": false,
      "DisableUrlRewrite": false,
      "DistinguishedName": "CN=xsoartest,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=xsoartest.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR07A123,DC=PROD,DC=OUTLOOK,DC=COM",
      "DoNotAllowClickThrough": false,
      "DoNotRewriteUrls": [
        "www.test.com",
        "https://xsoar.test.com"
      ],
      "DoNotTrackUserClicks": false,
      "EnableForInternalSenders": false,
      "EnableOrganizationBranding": false,
      "EnableSafeLinksForTeams": false,
      "ExchangeObjectId": "5796cea3-cfdb-4a99-9956-bf62209118a6",
      "ExchangeVersion": "0.20 (15.0.0.0)",
      "ExcludedUrls": [
        "www.test.com",
        "https://xsoar.test.com"
      ],
      "Guid": "5796cea3-cfdb-4a99-9956-bf62209118a6",
      "Id": "xsoartest",
      "Identity": "xsoartest",
      "IsBuiltInProtection": false,
      "IsDefault": false,
      "IsEnabled": true,
      "IsValid": true,
      "LocalizedNotificationTextList": [],
      "Name": "xsoartest",
      "ObjectCategory": "EURPR07A123.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config",
      "ObjectClass": [
        "top",
        "msExchSmartLinksProtectionConfig"
      ],
      "ObjectState": "Unchanged",
      "OrganizationId": "EURPR07A123.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/xsoartest.onmicrosoft.com - EURPR07A123.PROD.OUTLOOK.COM/ConfigurationUnits/xsoartest.onmicrosoft.com/Configuration",
      "OrganizationalUnitRoot": "xsoartest.onmicrosoft.com",
      "OriginatingServer": "AM7PR07A05DC123.EURPR07A123.PROD.OUTLOOK.COM",
      "PSComputerName": "outlook.office365.com",
      "PSShowComputerName": false,
      "RecommendedPolicyType": "Custom",
      "RunspaceId": "8501abb8-6d7c-45ca-bc0d-4c260d68d248",
      "ScanUrls": false,
      "TrackClicks": true,
      "WhenChanged": "2021-10-21T12:49:09+00:00",
      "WhenChangedUTC": "2021-10-21T12:49:09Z",
      "WhenCreated": "2021-10-21T12:49:03+00:00",
      "WhenCreatedUTC": "2021-10-21T12:49:03Z",
      "WhiteListedUrls": "www.test.com,https://xsoar.test.com"
    }
  ]
}

Human Readable Output

Results of o365-defender-safelinks-policy-create

AdminDisplayName	AllowClickThrough	CustomNotificationText	DeliverMessageAfterScan	DisableUrlRewrite	DistinguishedName	DoNotAllowClickThrough	DoNotRewriteUrls	DoNotTrackUserClicks	EnableForInternalSenders	EnableOrganizationBranding	EnableSafeLinksForTeams	ExchangeObjectId	ExchangeVersion	ExcludedUrls	Guid	Id	Identity	IsBuiltInProtection	IsDefault	IsEnabled	IsValid	LocalizedNotificationTextList	Name	ObjectCategory	ObjectClass	ObjectState	OrganizationalUnitRoot	OrganizationId	OriginatingServer	PSComputerName	PSShowComputerName	RecommendedPolicyType	RunspaceId	ScanUrls	TrackClicks	WhenChanged	WhenChangedUTC	WhenCreated	WhenCreatedUTC	WhiteListedUrls
Few URL	true	Sorry, you cant click through this URL	false	false	CN=XSOAR Policy,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=xsoartest.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR07A123,DC=PROD,DC=OUTLOOK,DC=COM	false		XSOAR Policy	EURPR07A123.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config	[“top”,”msExchSmartLinksProtectionConfig”]	Unchanged	xsoartest.onmicrosoft.com	EURPR07A123.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/xsoartest.onmicrosoft.com - EURPR07A123.PROD.OUTLOOK.COM/ConfigurationUnits/xsoartest.onmicrosoft.com/Configuration	AM7PR07A05DC123.EURPR07A123.PROD.OUTLOOK.COM	outlook.office365.com	false	Custom	{“value”:”8501abb8-6d7c-45ca-bc0d-4c260d68d248”,”Guid”:”8501abb8-6d7c-45ca-bc0d-4c260d68d248”}	false	true	{“value”:”2021-10-21T12:49:09+00:00”,”DateTime”:”Thursday, October 21, 2021 12:49:09 PM”}	{“value”:”2021-10-21T12:49:09Z”,”DateTime”:”Thursday, October 21, 2021 12:49:09 PM”}	{“value”:”2021-10-21T12:49:03+00:00”,”DateTime”:”Thursday, October 21, 2021 12:49:03 PM”}	{“value”:”2021-10-21T12:49:03Z”,”DateTime”:”Thursday, October 21, 2021 12:49:03 PM”}	www.test.com,https://xsoar.test.com

o365-defender-safelinks-policy-update

Update a Safe Links policy.

Base Command

o365-defender-safelinks-policy-update

Input

Context Output

Command Example

o365-defender-safelinks-policy-update name=xsoartest admin_display_name="Description for policy" do_not_allow_click_through=true

Context Example

{
  "O365Defender.SafeLinks.Policy(obj.Guid === val.Guid)": [
    {
      "AdminDisplayName": "Description for policy",
      "AllowClickThrough": true,
      "CustomNotificationText": "Sorry, you cant click through this URL",
      "DeliverMessageAfterScan": false,
      "DisableUrlRewrite": false,
      "DistinguishedName": "CN=xsoartest policy,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=xsoartest.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR07A123,DC=PROD,DC=OUTLOOK,DC=COM",
      "DoNotAllowClickThrough": false,
      "DoNotRewriteUrls": [
        "www.test.com",
        "https://xsoar.test.com"
      ],
      "DoNotTrackUserClicks": false,
      "EnableForInternalSenders": false,
      "EnableOrganizationBranding": false,
      "EnableSafeLinksForTeams": false,
      "ExchangeObjectId": "5796cea3-cfdb-4a99-9956-bf62209118a6",
      "ExchangeVersion": "0.20 (15.0.0.0)",
      "ExcludedUrls": [
        "www.test.com",
        "https://xsoar.test.com"
      ],
      "Guid": "5796cea3-cfdb-4a99-9956-bf62209118a6",
      "Id": "xsoartest policy",
      "Identity": "xsoartest policy",
      "IsBuiltInProtection": false,
      "IsDefault": false,
      "IsEnabled": true,
      "IsValid": true,
      "LocalizedNotificationTextList": [],
      "Name": "xsoartest",
      "ObjectCategory": "EURPR07A123.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config",
      "ObjectClass": [
        "top",
        "msExchSmartLinksProtectionConfig"
      ],
      "ObjectState": "Unchanged",
      "OrganizationId": "EURPR07A123.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/xsoartest.onmicrosoft.com - EURPR07A123.PROD.OUTLOOK.COM/ConfigurationUnits/xsoartest.onmicrosoft.com/Configuration",
      "OrganizationalUnitRoot": "xsoartest.onmicrosoft.com",
      "OriginatingServer": "AM7PR07A05DC123.EURPR07A123.PROD.OUTLOOK.COM",
      "PSComputerName": "outlook.office365.com",
      "PSShowComputerName": false,
      "RecommendedPolicyType": "Custom",
      "RunspaceId": "8501abb8-6d7c-45ca-bc0d-4c260d68d248",
      "ScanUrls": false,
      "TrackClicks": true,
      "WhenChanged": "2021-10-21T12:49:09+00:00",
      "WhenChangedUTC": "2021-10-21T12:49:09Z",
      "WhenCreated": "2021-10-21T12:49:03+00:00",
      "WhenCreatedUTC": "2021-10-21T12:49:03Z",
      "WhiteListedUrls": "www.test.com,https://xsoar.test.com"
    }
  ]
}

Human Readable Output

Results of o365-defender-safelinks-policy-list

AdminDisplayName	AllowClickThrough	CustomNotificationText	DeliverMessageAfterScan	DisableUrlRewrite	DistinguishedName	DoNotAllowClickThrough	DoNotRewriteUrls	DoNotTrackUserClicks	EnableForInternalSenders	EnableOrganizationBranding	EnableSafeLinksForTeams	ExchangeObjectId	ExchangeVersion	ExcludedUrls	Guid	Id	Identity	IsBuiltInProtection	IsDefault	IsEnabled	IsValid	LocalizedNotificationTextList	Name	ObjectCategory	ObjectClass	ObjectState	OrganizationalUnitRoot	OrganizationId	OriginatingServer	PSComputerName	PSShowComputerName	RecommendedPolicyType	RunspaceId	ScanUrls	TrackClicks	WhenChanged	WhenChangedUTC	WhenCreated	WhenCreatedUTC	WhiteListedUrls
Few URL	true	Sorry, you cant click through this URL	false	false	CN=XSOAR Policy,CN=Safe Links,CN=Transport Settings,CN=Configuration,CN=xsoartest.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR07A123,DC=PROD,DC=OUTLOOK,DC=COM	false		XSOAR Policy	EURPR07A123.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Smart-Links-Protection-Config	[“top”,”msExchSmartLinksProtectionConfig”]	Unchanged	xsoartest.onmicrosoft.com	EURPR07A123.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/xsoartest.onmicrosoft.com - EURPR07A123.PROD.OUTLOOK.COM/ConfigurationUnits/xsoartest.onmicrosoft.com/Configuration	AM7PR07A05DC123.EURPR07A123.PROD.OUTLOOK.COM	outlook.office365.com	false	Custom	{“value”:”8501abb8-6d7c-45ca-bc0d-4c260d68d248”,”Guid”:”8501abb8-6d7c-45ca-bc0d-4c260d68d248”}	false	true	{“value”:”2021-10-21T12:49:09+00:00”,”DateTime”:”Thursday, October 21, 2021 12:49:09 PM”}	{“value”:”2021-10-21T12:49:09Z”,”DateTime”:”Thursday, October 21, 2021 12:49:09 PM”}	{“value”:”2021-10-21T12:49:03+00:00”,”DateTime”:”Thursday, October 21, 2021 12:49:03 PM”}	{“value”:”2021-10-21T12:49:03Z”,”DateTime”:”Thursday, October 21, 2021 12:49:03 PM”}	www.test.com,https://xsoar.test.com

o365-defender-safelinks-policy-remove

Remove a Safe Links policy.

Base Command

o365-defender-safelinks-policy-remove

Input

Context Output

There is no context output for this command.

Command Example

!o365-defender-safelinks-policy-remove identity=XsoarTest

Human Readable Output

Policy with Identity: XsoarTest was removed succesfully

o365-defender-safelinks-rule-list

List Safe Links rules in your cloud-based organization.

Base Command

o365-defender-safelinks-rule-list

Input

Context Output

Command Example

#### Context Example

```json
{
  "O365Defender.SafeLinks.Rule(obj.Guid === val.Guid)": {
    "Comments": null,
    "Conditions": [
      "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.SentToPredicate"
    ],
    "Description": "If the message:\r\n\tIs sent to 'xsoartest@xsoar.onmicrosoft.com'\r\nTake the following actions:\r\n\tApply safe links policy \"XSOAR Policy\".\r\n",
    "DistinguishedName": "CN=XSOAR Policy,CN=SafeLinksVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=xsoartest.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR07A123,DC=PROD,DC=OUTLOOK,DC=COM",
    "ExceptIfRecipientDomainIs": null,
    "ExceptIfSentTo": null,
    "ExceptIfSentToMemberOf": null,
    "Exceptions": null,
    "ExchangeVersion": "0.1 (8.0.535.0)",
    "Guid": "e5764de3-5495-4512-93f5-fe96d579fbd9",
    "Identity": "XSOAR Policy",
    "ImmutableId": "e5764de3-5495-4512-93f5-fe96d579fbd9",
    "IsValid": true,
    "Name": "XSOAR Policy",
    "ObjectState": "Unchanged",
    "OrganizationId": "EURPR07A123.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/xsoartest.onmicrosoft.com - EURPR07A123.PROD.OUTLOOK.COM/ConfigurationUnits/xsoartest.onmicrosoft.com/Configuration",
    "PSComputerName": "outlook.office365.com",
    "PSShowComputerName": false,
    "Priority": 2,
    "RecipientDomainIs": null,
    "RuleVersion": {
      "Build": 0,
      "Major": 14,
      "MajorRevision": 0,
      "Minor": 0,
      "MinorRevision": 0,
      "Revision": 0
    },
    "RunspaceId": "72b57693-0ddb-45b0-a44f-4d722a352635",
    "SafeLinksPolicy": "XSOAR Policy",
    "SentTo": [
      "xsoartest@xsoar.onmicrosoft.com"
    ],
    "SentToMemberOf": null,
    "State": "Enabled",
    "WhenChanged": "2021-10-21T12:49:40+00:00"
  }
}
 

Human Readable Output

Results of o365-defender-safelinks-rule-list

Comments	Conditions	Description	DistinguishedName	ExceptIfRecipientDomainIs	ExceptIfSentTo	ExceptIfSentToMemberOf	Exceptions	ExchangeVersion	Guid	Identity	ImmutableId	IsValid	Name	ObjectState	OrganizationId	Priority	PSComputerName	PSShowComputerName	RecipientDomainIs	RuleVersion	RunspaceId	SafeLinksPolicy	SentTo	SentToMemberOf	State	WhenChanged
Changed recipients	“Microsoft.Exchange.MessagingPolicies.Rules.Tasks.SentToPredicate”	If the message: Is sent to ‘xsoartest@xsoar.onmicrosoft.com’\ Take the following actions: Apply safe links policy “XSOAR Policy”.\	CN=XSOAR Policy,CN=SafeLinksVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=xsoartest.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR07A123,DC=PROD,DC=OUTLOOK,DC=COM					0.1 (8.0.535.0)	{“value”:”e5764de3-5495-4512-93f5-fe96d579fbd9”,”Guid”:”e5764de3-5495-4512-93f5-fe96d579fbd9”}	XSOAR Policy	{“value”:”e5764de3-5495-4512-93f5-fe96d579fbd9”,”Guid”:”e5764de3-5495-4512-93f5-fe96d579fbd9”}	true	XSOAR Policy	Unchanged	EURPR07A123.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/xsoartest.onmicrosoft.com - EURPR07A123.PROD.OUTLOOK.COM/ConfigurationUnits/xsoartest.onmicrosoft.com/Configuration	2	outlook.office365.com	false		{“Major”:14,”Minor”:0,”Build”:0,”Revision”:0,”MajorRevision”:0,”MinorRevision”:0}	{“value”:”72b57693-0ddb-45b0-a44f-4d722a352635”,”Guid”:”72b57693-0ddb-45b0-a44f-4d722a352635”}	XSOAR Policy	“xsoartest@xsoar.onmicrosoft.com”		Enabled	{“value”:”2021-10-21T12:49:40+00:00”,”DateTime”:”Thursday, October 21, 2021 12:49:40 PM”}

o365-defender-safelinks-rule-create

Create a Safe Links rule in your cloud-based organization.

Base Command

o365-defender-safelinks-rule-create

Input

Context Output

Command Example

!o365-defender-safelinks-rule-create name="xsoartest rule" safe_links_policy="xsoartest policy" enabled=true sent_to=xsoartest@xsoar.onmicrosoft.com

Context Example

{
  "O365Defender.SafeLinks.Rule(obj.Guid === val.Guid)": {
    "Comments": null,
    "Conditions": [
      "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.SentToPredicate"
    ],
    "Description": "If the message:\r\n\tIs sent to 'xsoartest@xsoar.onmicrosoft.com'\r\nTake the following actions:\r\n\tApply safe links policy \"xsoartest policy"\".\r\n",
    "DistinguishedName": "CN=xsoartest rule,CN=SafeLinksVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=xsoartest.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR07A123,DC=PROD,DC=OUTLOOK,DC=COM",
    "ExceptIfRecipientDomainIs": null,
    "ExceptIfSentTo": null,
    "ExceptIfSentToMemberOf": null,
    "Exceptions": null,
    "ExchangeVersion": "0.1 (8.0.535.0)",
    "Guid": "e5764de3-5495-4512-93f5-fe96d579fbd9",
    "Identity": "XSOAR Policy",
    "ImmutableId": "e5764de3-5495-4512-93f5-fe96d579fbd9",
    "IsValid": true,
    "Name": "XSOAR Policy",
    "ObjectState": "Unchanged",
    "OrganizationId": "EURPR07A123.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/xsoartest.onmicrosoft.com - EURPR07A123.PROD.OUTLOOK.COM/ConfigurationUnits/xsoartest.onmicrosoft.com/Configuration",
    "PSComputerName": "outlook.office365.com",
    "PSShowComputerName": false,
    "Priority": 2,
    "RecipientDomainIs": null,
    "RuleVersion": {
      "Build": 0,
      "Major": 14,
      "MajorRevision": 0,
      "Minor": 0,
      "MinorRevision": 0,
      "Revision": 0
    },
    "RunspaceId": "72b57693-0ddb-45b0-a44f-4d722a352635",
    "SafeLinksPolicy": "xsoartest policy",
    "SentTo": [
      "xsoartest@xsoar.onmicrosoft.com"
    ],
    "SentToMemberOf": null,
    "State": "Enabled",
    "WhenChanged": "2021-10-21T12:49:40+00:00"
  }
}
 

Human Readable Output

Results of o365-defender-safelinks-rule-create

Comments	Conditions	Description	DistinguishedName	ExceptIfRecipientDomainIs	ExceptIfSentTo	ExceptIfSentToMemberOf	Exceptions	ExchangeVersion	Guid	Identity	ImmutableId	IsValid	Name	ObjectState	OrganizationId	Priority	PSComputerName	PSShowComputerName	RecipientDomainIs	RuleVersion	RunspaceId	SafeLinksPolicy	SentTo	SentToMemberOf	State	WhenChanged
Changed recipients	“Microsoft.Exchange.MessagingPolicies.Rules.Tasks.SentToPredicate”	If the message: Is sent to ‘xsoartest@xsoar.onmicrosoft.com’\ Take the following actions: Apply safe links policy “XSOAR Policy”.\	CN=XSOAR Policy,CN=SafeLinksVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=xsoartest.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR07A123,DC=PROD,DC=OUTLOOK,DC=COM					0.1 (8.0.535.0)	{“value”:”e5764de3-5495-4512-93f5-fe96d579fbd9”,”Guid”:”e5764de3-5495-4512-93f5-fe96d579fbd9”}	XSOAR Policy	{“value”:”e5764de3-5495-4512-93f5-fe96d579fbd9”,”Guid”:”e5764de3-5495-4512-93f5-fe96d579fbd9”}	true	XSOAR Policy	Unchanged	EURPR07A123.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/xsoartest.onmicrosoft.com - EURPR07A123.PROD.OUTLOOK.COM/ConfigurationUnits/xsoartest.onmicrosoft.com/Configuration	2	outlook.office365.com	false		{“Major”:14,”Minor”:0,”Build”:0,”Revision”:0,”MajorRevision”:0,”MinorRevision”:0}	{“value”:”72b57693-0ddb-45b0-a44f-4d722a352635”,”Guid”:”72b57693-0ddb-45b0-a44f-4d722a352635”}	XSOAR Policy	“xsoartest@xsoar.onmicrosoft.com”		Enabled	{“value”:”2021-10-21T12:49:40+00:00”,”DateTime”:”Thursday, October 21, 2021 12:49:40 PM”}

o365-defender-safelinks-rule-update

Update a given Safe Links rule.

Base Command

o365-defender-safelinks-rule-update

Input

Context Output

Command Example

!o365-defender-safelinks-rule-update name=XSOAR Rule safe_links_policy=XSOAR Policy comments="Description of the updated rule"

Context Example

{
  "O365Defender.SafeLinks.Rule(obj.Guid === val.Guid)": {
    "Comments": "Description of the updated rule",
    "Conditions": [
      "Microsoft.Exchange.MessagingPolicies.Rules.Tasks.SentToPredicate"
    ],
    "Description": "If the message:\r\n\tIs sent to 'xsoartest@xsoar.onmicrosoft.com'\r\nTake the following actions:\r\n\tApply safe links policy \"XSOAR Policy\".\r\n",
    "DistinguishedName": "CN=XSOAR Policy,CN=SafeLinksVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=xsoartest.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR07A123,DC=PROD,DC=OUTLOOK,DC=COM",
    "ExceptIfRecipientDomainIs": null,
    "ExceptIfSentTo": null,
    "ExceptIfSentToMemberOf": null,
    "Exceptions": null,
    "ExchangeVersion": "0.1 (8.0.535.0)",
    "Guid": "e5764de3-5495-4512-93f5-fe96d579fbd9",
    "Identity": "XSOAR Policy",
    "ImmutableId": "e5764de3-5495-4512-93f5-fe96d579fbd9",
    "IsValid": true,
    "Name": "XSOAR Rule",
    "ObjectState": "Unchanged",
    "OrganizationId": "EURPR07A123.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/xsoartest.onmicrosoft.com - EURPR07A123.PROD.OUTLOOK.COM/ConfigurationUnits/xsoartest.onmicrosoft.com/Configuration",
    "PSComputerName": "outlook.office365.com",
    "PSShowComputerName": false,
    "Priority": 2,
    "RecipientDomainIs": null,
    "RuleVersion": {
      "Build": 0,
      "Major": 14,
      "MajorRevision": 0,
      "Minor": 0,
      "MinorRevision": 0,
      "Revision": 0
    },
    "RunspaceId": "72b57693-0ddb-45b0-a44f-4d722a352635",
    "SafeLinksPolicy": "XSOAR Policy",
    "SentTo": [
      "xsoartest@xsoar.onmicrosoft.com"
    ],
    "SentToMemberOf": null,
    "State": "Enabled",
    "WhenChanged": "2021-10-21T12:49:40+00:00"
  }
}
 

Human Readable Output

Results of o365-defender-safelinks-rule-update

Comments	Conditions	Description	DistinguishedName	ExceptIfRecipientDomainIs	ExceptIfSentTo	ExceptIfSentToMemberOf	Exceptions	ExchangeVersion	Guid	Identity	ImmutableId	IsValid	Name	ObjectState	OrganizationId	Priority	PSComputerName	PSShowComputerName	RecipientDomainIs	RuleVersion	RunspaceId	SafeLinksPolicy	SentTo	SentToMemberOf	State	WhenChanged
Changed recipients	“Microsoft.Exchange.MessagingPolicies.Rules.Tasks.SentToPredicate”	If the message: Is sent to ‘xsoartest@xsoar.onmicrosoft.com’\ Take the following actions: Apply safe links policy “XSOAR Policy”.\	CN=XSOAR Policy,CN=SafeLinksVersioned,CN=Rules,CN=Transport Settings,CN=Configuration,CN=xsoartest.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR07A123,DC=PROD,DC=OUTLOOK,DC=COM					0.1 (8.0.535.0)	{“value”:”e5764de3-5495-4512-93f5-fe96d579fbd9”,”Guid”:”e5764de3-5495-4512-93f5-fe96d579fbd9”}	XSOAR Policy	{“value”:”e5764de3-5495-4512-93f5-fe96d579fbd9”,”Guid”:”e5764de3-5495-4512-93f5-fe96d579fbd9”}	true	XSOAR Policy	Unchanged	EURPR07A123.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/xsoartest.onmicrosoft.com - EURPR07A123.PROD.OUTLOOK.COM/ConfigurationUnits/xsoartest.onmicrosoft.com/Configuration	2	outlook.office365.com	false		{“Major”:14,”Minor”:0,”Build”:0,”Revision”:0,”MajorRevision”:0,”MinorRevision”:0}	{“value”:”72b57693-0ddb-45b0-a44f-4d722a352635”,”Guid”:”72b57693-0ddb-45b0-a44f-4d722a352635”}	XSOAR Policy	“xsoartest@xsoar.onmicrosoft.com”		Enabled	{“value”:”2021-10-21T12:49:40+00:00”,”DateTime”:”Thursday, October 21, 2021 12:49:40 PM”}

o365-defender-safelinks-detailed-report-get

Get detailed information about Safe Links results for the last 7 days. Yesterday is the most recent date that you can specify.

Base Command

o365-defender-safelinks-detailed-report-get

Input

Context Output

Command example

!o365-defender-safelinks-detailed-report-get end_date=08-01-2022 start_date=07-31-2022

Context Example

{
    "O365Defender": {
        "SafeLinks": {
            "DetailedReport": {
                "Data": [
                    {
                        "Action": "Allowed",
                        "AppName": "Email Client",
                        "ClickTime": "2022-08-01T10:12:49",
                        "ClientMessageId": null,
                        "DetectedBy": "ATP safe links",
                        "EndDate": "0001-01-01T00:00:00",
                        "Flags": 0,
                        "InternalMessageId": "dc6ebe31-e968-4cf8-a4b4-08da73a65b1c",
                        "Organization": "test.onmicrosoft.com",
                        "PSComputerName": "outlook.office365.com",
                        "PSShowComputerName": false,
                        "RecipientAddress": "test@test.onmicrosoft.com",
                        "RunspaceId": "93d2c78c-db42-41a0-b67c-5f72881b7338",
                        "SenderAddress": null,
                        "SourceId": null,
                        "StartDate": "0001-01-01T00:00:00",
                        "Url": "http://go.microsoft.com/",
                        "UrlDomain": "go.microsoft.com",
                        "UrlType": ""
                    }
                ],
                "ReportId": "93d2c78c-db42-41a0-b67c-5f72881b7338"
            }
        }
    }
}

Human Readable Output

Results of o365-defender-safelinks-detailed-report-get

o365-defender-safelinks-aggregate-report-get

general information about Safe Links results for the last 90 days. Yesterday is the most recent date that you can specify.

Base Command

o365-defender-safelinks-aggregate-report-get

Input

Context Output

Command example

!o365-defender-safelinks-aggregate-report-get end_date=08-01-2022 start_date=07-31-2022

Context Example

{
    "O365Defender": {
        "SafeLinks": {
            "AggregateReport": {
                "Data": [
                    {
                        "Action": "Allowed",
                        "App": "",
                        "EndDate": "0001-01-01T00:00:00",
                        "MessageCount": 0,
                        "PSComputerName": "outlook.office365.com",
                        "PSShowComputerName": false,
                        "RecipientCount": 0,
                        "RunspaceId": "e3633f6c-e9b5-4c9d-9acc-8f669b28a974",
                        "StartDate": "0001-01-01T00:00:00"
                    },
                    {
                        "Action": "TenantAllowed",
                        "App": "",
                        "EndDate": "0001-01-01T00:00:00",
                        "MessageCount": 0,
                        "PSComputerName": "outlook.office365.com",
                        "PSShowComputerName": false,
                        "RecipientCount": 0,
                        "RunspaceId": "e3633f6c-e9b5-4c9d-9acc-8f669b28a974",
                        "StartDate": "0001-01-01T00:00:00"
                    },
                    {
                        "Action": "Blocked",
                        "App": "",
                        "EndDate": "0001-01-01T00:00:00",
                        "MessageCount": 0,
                        "PSComputerName": "outlook.office365.com",
                        "PSShowComputerName": false,
                        "RecipientCount": 0,
                        "RunspaceId": "e3633f6c-e9b5-4c9d-9acc-8f669b28a974",
                        "StartDate": "0001-01-01T00:00:00"
                    },
                    {
                        "Action": "TenantBlocked",
                        "App": "",
                        "EndDate": "0001-01-01T00:00:00",
                        "MessageCount": 0,
                        "PSComputerName": "outlook.office365.com",
                        "PSShowComputerName": false,
                        "RecipientCount": 0,
                        "RunspaceId": "e3633f6c-e9b5-4c9d-9acc-8f669b28a974",
                        "StartDate": "0001-01-01T00:00:00"
                    },
                    {
                        "Action": "ClickedEvenBlocked",
                        "App": "",
                        "EndDate": "0001-01-01T00:00:00",
                        "MessageCount": 0,
                        "PSComputerName": "outlook.office365.com",
                        "PSShowComputerName": false,
                        "RecipientCount": 0,
                        "RunspaceId": "e3633f6c-e9b5-4c9d-9acc-8f669b28a974",
                        "StartDate": "0001-01-01T00:00:00"
                    },
                    {
                        "Action": "TenantBlockedAndClickedThrough",
                        "App": "",
                        "EndDate": "0001-01-01T00:00:00",
                        "MessageCount": 0,
                        "PSComputerName": "outlook.office365.com",
                        "PSShowComputerName": false,
                        "RecipientCount": 0,
                        "RunspaceId": "e3633f6c-e9b5-4c9d-9acc-8f669b28a974",
                        "StartDate": "0001-01-01T00:00:00"
                    },
                    {
                        "Action": "Scanning",
                        "App": "",
                        "EndDate": "0001-01-01T00:00:00",
                        "MessageCount": 0,
                        "PSComputerName": "outlook.office365.com",
                        "PSShowComputerName": false,
                        "RecipientCount": 0,
                        "RunspaceId": "e3633f6c-e9b5-4c9d-9acc-8f669b28a974",
                        "StartDate": "0001-01-01T00:00:00"
                    },
                    {
                        "Action": "ClickedDuringScan",
                        "App": "",
                        "EndDate": "0001-01-01T00:00:00",
                        "MessageCount": 0,
                        "PSComputerName": "outlook.office365.com",
                        "PSShowComputerName": false,
                        "RecipientCount": 0,
                        "RunspaceId": "e3633f6c-e9b5-4c9d-9acc-8f669b28a974",
                        "StartDate": "0001-01-01T00:00:00"
                    }
                ],
                "ReportId": "e3633f6c-e9b5-4c9d-9acc-8f669b28a974"
            }
        }
    }
}

Human Readable Output

Results of o365-defender-safelinks-aggregate-report-get

Known Limitations

Base Command

o365-defender-safelinks-atp-policy-get

Input

There are no input arguments for this command.

Context Output

o365-defender-safelinks-atp-policy-set

Set the ATP policy.

Base Command

o365-defender-safelinks-atp-policy-set

Input

Context Output

There is no context output for this command.

• Safe Links does not work on mail-enabled public folders.
• Safe Links protection is available in the following locations:
  • Office 365 apps: Safe Links protection for Office 365 apps is available in supported desktop, mobile, and web apps. You configure Safe Links protection for Office 365 apps in the global setting that are outside of Safe Links policies. For instructions, see Configure global settings for Safe Links settings in Microsoft Defender for Office 365.
  • Microsoft Teams: Safe Links protection for links in Teams conversations, group chats, or from channels is also controlled by Safe Links policies. There is no default Safe Links policy, so to get the protection of Safe Links in Teams, you need to create one or more Safe Links policies.
  • Email messages: Safe Links protection for links in email messages is controlled by Safe Links policies. There is no default Safe Links policy, so to get the protection of Safe Links in email messages, you need to create one or more Safe Links policies.
• Allow up to 30 minutes for a new or updated policy to be applied.
• Organization - be sure to use an .onmicrosoft.com domain in the Organization parameter value. Otherwise, you might encounter cryptic permission issues when you run commands in the app context.