Threat Explorer

Product

A Microsoft Defender for Office 365 Plan 2 tool for searching email detections, delivery actions and campaigns across a tenant.

Title graphic: Threat Explorer (Product)

Type	Product

Key points about Threat Explorer

Weekly reviews with Threat Explorer and Message Trace treat Defender as a living system. · Tune Microsoft Defender for Office 365 Against…
Hidden Defender signals include Threat Explorer campaign relationships, AIR outcomes and User Submissions. · Build Better Phishing Reports with Defender…

Episodes about Threat Explorer

Defender for Office 365

2026-10-29 · Video on YouTube

Most tenants run Microsoft Defender for Office 365 on defaults and assume they are protected while attackers test their filters every day. This episode is for email security admins, security engineers and SOC teams who want to tune anti-phishing, Safe Links…

Tune Microsoft Defender for Office 365 Against Phishing

2025-08-05 · Video on YouTube

Your users still click phish—even with Defender for M365 “fully enabled.” The culprit isn’t the attackers; it’s misaligned layers: Safe Links, Safe Attachments, anti-phishing ML, and mail flow rules that overlap, conflict, or leave gaps. This guide traces how…

Build Better Phishing Reports with Defender and Power BI

2025-08-05 · Video on YouTube

Your phishing dashboard is lying to you. The “all good” charts hide near-miss clicks, silent investigations, and active campaigns threading your inboxes right now. We show how to tap Microsoft Defender’s buried signals and build living Power BI dashboards…

Timeline of episodes about Threat Explorer

Articles about Threat Explorer (3)

Safe Links and Safe Attachments: Your First Line of Defense
2026-08-13 · Mirko Peters
Welcome back to the podcast companion blog! In today's digital landscape, protecting your organization from ever-evolving cyber threats is no longer optional—…
Executive KPIs That Actually Change Behavior: Moving Beyond Compliance
2026-08-11 · Mirko Peters
Welcome back, security leaders and data architects! As a podcaster who spends hours every week talking to CISOs, SOC leads, and enterprise architects, I hear the sa…
Why 'Set-and-Forget' Fails: Treating Microsoft Defender as a Living System
2026-08-11 · Mirko Peters
Welcome back to the podcast and our ongoing deep dives into securing your cloud environment. If you have ever felt that sinking feeling when a sophisticated phishin…

Frequently asked questions

How should you maintain Defender over time?

Run weekly reviews using Threat Explorer and Message Trace, and tune policies continuously. The episode treats Defender as a living system rather than a checklist. · From the episode: Tune Microsoft Defender for Office 365 Against…

What hidden Defender data should phishing reports use?

Threat Explorer for campaign relationships, AIR for correlated actions and background playbooks, and User Submissions for the human signal that often flags what filters missed. · From the episode: Build Better Phishing Reports with Defender…

Glossary

Community wiki

Short info above, community knowledge below: add practical tips, examples or corrections. New contributions are reviewed first; trusted members publish directly.

Experts and companies for this topic

Nobody has listed this topic yet. Add it to your profile.

Sources

Feed for this topic (RSS): entity/threat-explorer/feed.xml
M365.FM episodes on this topic: 3
Articles on this topic: 3

Maintained by Mirko Peters (Microsoft MVP) · Last updated: 2026-11-03