In advanced hunting, the Take action wizard now lets customers allow or block top-level domains and files attachment hashes in emails based on query results.

From Microsoft's description: “In advanced hunting, the Take action wizard now lets customers allow or block top-level domains and files attachment hashes in emails based on query results.”

In advanced hunting, the Take action wizard now lets customers allow or block top-level domains and files attachment hashes in emails based on query results. Learn more.

Affected: Microsoft Defender XDR, Advanced Hunting

Related changes

• Advanced hunting now lets you investigate Microsoft Defender for Cloud behaviors. · Lets
• Microsoft Defender Experts MDR customers can now see Defender Experts as a… · Customers
• Customers can now use filters on very large incidents with many alerts and… · Customers
• Microsoft Defender Experts Hunting customers can now set up Notification contacts. · Customers
• Microsoft Security Copilot in Microsoft Defender now lets you hunt for… · Lets
• Microsoft Sentinel customers using the Defender portal, or the Azure portal… · Customers

View at Microsoft → Copy summary