Reviewing and Responding to Threats Identified in Defender for Office 365
Email-based threats are some of the most common that organizations face. In this section, you’ll look at the various panes where email threats can be viewed and processed.
Email & Collaboration Alerts
You can review alerts and notifications under the Email & collaboration alerts section of Incidents & alerts, as shown in Figure 8.12:
Figure 8.12 – Viewing Email & collaboration alerts
A wide variety of alerts can show up here, including alerts that have to do with email-borne threats as well as information protection alerts. If warranted, Microsoft 365 Defender will aggregate alerts and create an incident for them.
Further Reading
For more on overall incident management, see Chapter 7, Managing Security Reports and Alerts by the Using Microsoft 365 Defender Portal.
Investigations
The Investigations page is used to track and manage AIR...