capability

MDO Advanced Hunting

Defender for Office 365 Plan 2 exposes email and collaboration telemetry in Microsoft Defender XDR advanced hunting for KQL-based investigation across messages, URLs, attachments, campaigns, clicks, and post-delivery actions.

capabilitiesCurrent

Relationships

Microsoft Defender for Office 365
Source productproductMicrosoft Defender for Office 365 Plan 2
Required licenselicenseEmailEvents
Related tabletableEmailUrlInfo
Related tabletableEmailAttachmentInfo
Related tabletableEmailPostDeliveryEvents
Related tabletableUrlClickEvents
Related tabletableCampaignInfo
Related tabletableFileMaliciousContentInfo
Related tabletableMessageEvents
Related tabletableMessageUrlInfo
Related tabletableMessagePostDeliveryEvents
Related tabletableMicrosoft Graph Security API
API accessapiLegacy Microsoft Defender XDR APIs
API accessapi

Configuration Methods

MethodSupportReference or Gap
PortalSupported Reference
PowerShellSupported Reference
REST APISupported Reference
GraphSupported Reference
ARMGapNo ARM resource is recorded for this capability.
BicepGapNo Bicep resource is recorded for this capability.
TerraformGapAdvanced hunting query execution is API/script automation, not Terraform desired state.
GitHub ActionsSupported Reference
Azure DevOpsSupported Reference