A New Qiita Article: Investigating Phishing Campaigns with Defender XDR and Sentinel

Eventus has published a new engineering article on Qiita: “Shifting Phishing Investigations from a Single Email to a Campaign: Scoping Impact with Defender XDR and Sentinel” (「フィッシング調査を『1通のメール』から『キャンペーン単位』に切り替える―Defender XDRとSentinelで影響範囲を出す」).

The article explains how Defender XDR's CampaignInfo, EmailEvents, and UrlClickEvents, together with Microsoft Sentinel's imAuthentication, can be used to scope campaign recipients, URL clicks, and sign-ins after a click. It also outlines practical SIEM+ triage.

Read the article

If you are investigating phishing and want to assess the reach of a campaign across email, click, and authentication activity, read the full article:

Read the Defender XDR and Sentinel phishing investigation article on Qiita

To learn more about Eventus's security services, contact Eventus.