Threats Surrounding M365 and CDR (Cloud Detection and Response)

It goes without saying that Microsoft Office 365 (M365) environments, where important business information is concentrated, are easy targets for attackers.

In fact, if there are signs of unauthorized access to services on M365 or data exfiltration, it must be dealt with as soon as possible. However, if you can't notice the signs, it will be irreversible, such as data being leaked multiple times or data being encrypted.

The solution to solve this problem is "Cloud Detection and Response (CDR)".

CDR is a solution that detects and responds to threats for various workloads on the cloud.

Detect for Microsoft 365, one of Vectra AI's CDRs, is a new solution that covers M365-specific attack methods and visualizes, detects, and responds to threats within M365.

Attacker action phase and solution coverage

What is Vectra AI's CDR solution Vectra AI Detect for M365?

Monitor all accounts on M365 and visualize the behavior of accounts obtained illegally by attackers.

By detecting account behavior such as the suspension of security tools, creation of suspicious email sending rules, and suspicious file downloads, it is possible to quickly notice intrusion by attackers.

This solution has the following characteristics:

simple introduction

• About 10 minutes from installation to start of operation
• Agentless deployment

High precision detection

• Detection logic following the MITER framework
• Suppression of false positives

Operate with low load

• Automated detection, triage and prioritization ^based on Attack Signal Intelligence*
• Realization of speedy response
• Centralized management from on-premises to cloud environments

Introduction flow

Since it is provided as SaaS, the necessary processes from introduction to operation start can be completed in about 10 minutes.

Please contact us if you would like a free trial.

STEP1

Detect for Azure AD trial registration

STEP2

Creation and registration of SaaS sensors

STEP3

Checking Azure AD admin rights

STEP4

Allow Azure AD Log Access Permission

STEP5

Setup complete

Vectra AI MDR（Management Detection and Response）

Vectra MDR (Threat Detection and Response Operations) Service

Combining Vectra's detection capabilities with the human intelligence of our team of analysts, we can respond more quickly to unknown threats.

Even after product introduction, the operational burden of your own SOC will not increase.
Our team of Vectra analysts is available 24/7 with their expertise.

*MDR: Managed Detection Response

Vectra AI's analyst team will use Vectra AI to monitor the customer's environment on behalf of the customer, as well as propose thread hunting and product usage optimization using Vectra AI.