Microsoft adds Teams message snippets to Defender threat hunting
The MessageContents table will expose content and metadata to authorized analysts, forcing administrators to revisit who can read collaboration data.
By Ryan Merket · Published
Primary source: MS Message Center
Why it matters
Teams investigations have relied heavily on URLs, verdicts and message metadata. Queryable snippets give analysts crucial context, while making least-privilege access to employee communications a more urgent administrative requirement.
Microsoft will add Teams message snippets to Defender XDR's Advanced Hunting service, giving authorized security analysts content-level data they can correlate with alerts, identities and other evidence during an investigation.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.