SOC wants email when more than 10 users receive malware in one hour…

Question

SOC wants email when more than 10 users receive malware in one hour. What should be configured?

Accepted Answer

Defender for Office 365 / Microsoft 365 Defender alert policy with threshold for malware detections and email notification — Alert policies are the smoke alarm with a threshold. Ten malware hits in an hour means campaign.

Answer

A sensitivity label auto-apply policy only

Answer

SSPR registration campaign

Answer

Copilot adoption report

SOC wants email when more than 10 users receive malware in one hour. What should be configured?

Short Explanation and Infographic

Full Explanation