A SOC receives an incident involving malicious email delivery, phishing links, and suspicious mailbox activity. Which Microsoft workload is most directly associated with investigating and remediating that threat in Defender XDR?

Question

Accepted Answer

A. Microsoft Defender for Office 365. Defender for Office 365 is the workload used for investigating and remediating email-borne threats such as phishing and malware in email. Option b is wrong because Microsoft Entra ID focuses on identity signals rather than email threat investigation.

A SOC receives an incident involving malicious email delivery, phishing links, and suspicious mailbox activity. Which Microsoft workload is most directly associated with investigating and remediating that threat in Defender XDR?

Related Questions

Discussion