Office 365 Threat Intelligence Helps Monitor Malware

Office 365 Threat Intelligence is a set of tools that organizations can use to investigate suspicious activity, such as malware, phishing, and other attacks, detected by Office 365. The tools in the service can help organizations understand the severity of threats, primarily discovered in incoming e-mail. However, Threat Intelligence is only effective when combined with other services to protect an organization against attacks.

Components of Threat Intelligence

Office 365 Threat Intelligence uses information from an organization’s Office 365 tenant (primarily Exchange Online malware mitigation results) and information about globally active malware outbreaks to improve an organization’s ability to recognize and act on incoming threats.

Office 365 Threat Intelligence consists of three separate services, which appear in the Office 365 Security & Compliance Admin portal:

The Threat dashboard page shows administrators which incoming e-mail threats have already been mitigated by Exchange Online Protection or Office 365 Advanced Threat Protection (ATP). This service provides information regarding the categorization of detected malware, the geographic regions where the attacks originated, and users who have received the largest volume of e-mail impacted by the attacks. The Threat dashboard information is supplemented with a feed of information about recent global malware attacks against all Office 365 tenants. The Threat dashboard does not currently provide metrics regarding an organization’s malware volume compared with similar organizations across Office 365.