8.9 Automated Investigation and Response for Email

Automated Investigation and Response for Email

By the end of this subsection, you will understand how AIR automates email threat investigation, know the approval workflow, and be able to monitor AIR effectiveness.

How email AIR works

When Defender for Office 365 detects a phishing email or malware, AIR automatically:

1. Identifies the threat — classifies the email as phishing, malware, or spam
2. Scopes the campaign — finds all related emails (same sender, URL, or attachment hash)
3. Identifies affected users — which mailboxes received the campaign
4. Recommends remediation — soft delete from all affected mailboxes
5. Executes or waits — depending on your automation level, either acts immediately or waits for analyst approval

Automation levels for email

Monitoring AIR effectiveness

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

AlertInfo
| where TimeGenerated > ago(30d)
| where ServiceSource == "Microsoft Defender for Office 365"
| where Category has "Phish" or Category has "Malware"
| summarize
    TotalAlerts = count(),
    AutoRemediated = countif(InvestigationState == "Remediated"),
    PendingApproval = countif(InvestigationState == "Pending"),
    NoAction = countif(InvestigationState == "NoThreatsFound")
| extend AutoRate = round(AutoRemediated * 100.0 / TotalAlerts, 1)

Reviewing AIR investigations

When AIR completes an email investigation, review these elements before approving:

1. Scope accuracy: Did AIR identify all emails in the campaign? Compare the count against your manual Threat Explorer search. If AIR found 18 but you find 23, there are 5 emails AIR missed — remediate manually.

2. Verdict confidence: Check the confidence level of the phishing/malware classification. High confidence = approve quickly. Low confidence = review sample emails before approving.

3. Recommended actions: Is soft delete appropriate, or do some emails need hard delete (e.g., malware that users might restore from Recoverable Items)?

4. Affected users: Review the list of affected mailboxes. Any VIP users? Any service accounts? VIPs may need additional follow-up (Module 13.7 phone notification).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

// Track AIR investigation outcomes over time
AlertInfo
| where TimeGenerated > ago(30d)
| where ServiceSource == "Microsoft Defender for Office 365"
| summarize
    Investigations = count(),
    Remediated = countif(InvestigationState == "Remediated"),
    Approved = countif(InvestigationState == "PendingApproval"),
    Failed = countif(InvestigationState == "Failed")
    by bin(TimeGenerated, 7d)
| extend SuccessRate = round(Remediated * 100.0 / Investigations, 0)
| sort by TimeGenerated asc