This repository will centralize articles and real-world examples related to Microsoft Defender for Office 365, with a specific focus on Exchange Online and email protection.
Microsoft Defender for Office 365 offers multiple layers of protection to detect, investigate, and respond to threats targeting Exchange Online.
This repository aims to share use cases, hunting queries, investigation scenarios, and technical notes based on real-life experience in production environments.
- 🎯 Targeted attack protection (phishing, spoofing, malware)
- 🧠 Threat investigation using Microsoft 365 Defender and Email Entity
- 📬 Message headers analysis (SPF, DKIM, DMARC)
- 🔍 Advanced Hunting (KQL queries focused on email events)
- 🗂️ Email Quarantine & Threat Explorer
- 🔁 Auto-remediation and manual response workflows
- 🛠️ PowerShell scripts for reporting or investigation
All content in this repository is shared for educational purposes and based on hands-on experience.
Articles will be added progressively as they are written and validated.
This repository is published under the CC BY 4.0 license.