KQL Search

Query Details

HomeAI ToolsDevice Query

Email Audit Safe Attachments Global Setting

Query

name : Safe Attachments 
description : 
- Audit the config - [Safe Attachments for SharePoint, OneDrive, and Microsoft Teams]
- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-configure?view=o365-worldwide
query : |
   let StartTime = datetime(2023-01-22);
   let EndTime = datetime(2023-01-24);
   CloudAppEvents
   | where Timestamp between ((StartTime) .. (EndTime))
   | where Application == "Microsoft Exchange Online"
   | where ActionType contains "atp"

output : 
 Parameters 
  [
    {"Name":"Identity","Value":"Default"},
    {"Name":"EnableATPForSPOTeamsODB","Value":"True"},
    {"Name":"EnableSafeDocs","Value":"True"},
    {"Name":"AllowSafeDocsOpen","Value":"False"}
  ]

Explanation

The query is retrieving cloud app events from Microsoft Exchange Online between January 22, 2023, and January 24, 2023. It filters the events to only include those related to Advanced Threat Protection (ATP). The output of the query includes parameters related to Safe Attachments, such as enabling ATP for SharePoint, OneDrive, and Teams, enabling SafeDocs, and allowing SafeDocs to be opened.

Details

Kijo Girardi profile picture

Kijo Girardi

Released: February 2, 2023

Tables

CloudAppEvents

Keywords

SafeAttachments,SharePoint,OneDrive,MicrosoftTeams,Audit,config,StartTime,EndTime,CloudAppEvents,Timestamp,Application,ActionType,EnableATPForSPOTeamsODB,EnableSafeDocs,AllowSafeDocsOpen

Operators

toscalar()arg_max()count()mv-expand

Actions