Edit

MailGuard 365 connector for Microsoft Sentinel

  • Article

MailGuard 365 Enhanced Email Security for Microsoft 365. Exclusive to the Microsoft marketplace, MailGuard 365 is integrated with Microsoft 365 security (incl. Defender) for enhanced protection against advanced email threats like phishing, ransomware and sophisticated BEC attacks.

Connector attributes

Connector attribute Description
Log Analytics table(s) MailGuard365_Threats_CL
Data collection rules support Not currently supported
Supported by MailGuard 365

Query samples

All phishing threats stopped by MailGuard 365

MailGuard365_Threats_CL 

| where Category == "Phishing"

All threats summarized by sender email address

MailGuard365_Threats_CL 

| summarize count() by Sender_Email_s

All threats summarized by category

MailGuard365_Threats_CL 

| summarize count() by Category

Vendor installation instructions

Configure and connect MailGuard 365

  1. In the MailGuard 365 Console, click Settings on the navigation bar.
  2. Click the Integrations tab.
  3. Click the Enable Microsoft Sentinel.
  4. Enter your workspace id and primary key from the fields below, click Finish.
  5. For additional instructions, please contact MailGuard 365 support.

Next steps

For more information, go to the related solution in the Azure Marketplace.