Microsoft 365 Defender - Emails Indicators Hunt
This playbook retrieves email data based on the "URLDomain", "SHA256" and "IPAddress" inputs. SHA256 - Emails with attachments matching the "SHA256" input are retrieved. URLDomain - If the "URLDomain" value is found as a substring of URL(s) in the body of the email, the email is retrieved. IPAddress - Emails with "SenderIPv4"/SenderIPv6" or URLs (in the body) matching the "IPAddress" input are retrieved.
- Pack
- Microsoft365Defender
- Tasks
- 15
Inputs
- URLDomain — Domain or URL to search within emails. Can be a single domain or URL or an array of domains or URLs to search. The search looks for the exact Domain or URL.
- SHA256 — The SHA256 hash file or an array of hashes to search within emails.
- IPAddress — The source or destination IP address to search. Can be a single address or an array of IP addresses.
- Timeout — The time limit in seconds for the HTTP request to run. Default is 180.
- SearchTimeframe — Number of days past to search. Default is 7.
- ResultsLimit — Number of retrieved entries. Enter -1 for unlimited query. 50 is the default.
- ListenerMailbox — The mailbox of the listening integration. In case it is provided, the emails found in it will be ignored.
Outputs
- Microsoft365Defender.RetrievedEmails — Email objects containing relevant fields.
- Microsoft365Defender.RetrievedEmails.InternetMessageId — Internet Message ID of the email.
- Microsoft365Defender.RetrievedEmails.SenderFromDomain — Sender domain.
- Microsoft365Defender.RetrievedEmails.EmailDirection — Email direction (inbound/outbound).
- Microsoft365Defender.RetrievedEmails.DeliveryLocation — Delivery location.
- Microsoft365Defender.RetrievedEmails.AuthenticationDetails — Authentication details (SPF, DKIM, DMARC, CompAuth).
- Microsoft365Defender.RetrievedEmails.DeliveryAction — Delivery action.
- Microsoft365Defender.RetrievedEmails.Subject — Email subject.
- Microsoft365Defender.RetrievedEmails.AttachmentCount — Number of attachments.
- Microsoft365Defender.RetrievedEmails.ThreatNames — Threat names.
- Microsoft365Defender.RetrievedEmails.RecipientEmailAddress — Recipient email address.
- Microsoft365Defender.RetrievedEmails.EmailAction — Email action.
- Microsoft365Defender.RetrievedEmails.EmailLanguage — Email language.
- Microsoft365Defender.RetrievedEmails.SenderFromAddress — Sender address.
- Microsoft365Defender.RetrievedEmails.Timestamp — Timestamp.
- Microsoft365Defender.RetrievedEmails.SenderDisplayName — Sender display name.
- Microsoft365Defender.RetrievedEmails.SenderIPv4 — Sender IPv4
- Microsoft365Defender.RetrievedEmails.ConfidenceLevel — Confidence level.
- Microsoft365Defender.RetrievedEmails.ThreatTypes — Threat types.
- Microsoft365Defender.RetrievedEmails.SHA256 — SHA256 of the attachments (if exists in the email).
- Microsoft365Defender.RetrievedEmails.Url — URLs found in the email's body.
- Microsoft365Defender.RetrievedEmails.UrlCount — Number of URLs found in the email's body.
- Microsoft365Defender.RetrievedEmails.SenderIPv6 — Sender IPv6.
Commands used
- microsoft-365-defender-advanced-hunting