Sign Vermont Permission Slip Secure

Document type sign permission slip maine safe

hey welcome back what keeps me up at night is many different things so one of those things is phishing email especially when a user receives a malicious attachment and an email and they go to run it on their device so i want to show you a capability inside microsoft 365 called safe documents and what this does is when you download a file from say your email or maybe just from the internet it's going to open it up in protected view first and then it's going to take a copy that file send it off to microsoft defender for endpoint formally known as microsoft defender advanced threat protection sandbox it and scan it and if it's found to be malicious it actually stops you from being able to do anything else in the document other than read it so no printing no exporting no saving or anything like that if it's found to be safe it allows you just go ahead and proceed with using the document i think you're really going to like this this is just a basic feature that everybody should be enabling to help better secure their environment so let's take a look at how you set this up okay let's first take a look at this in action so here i have an email uh this email is from matt sussman at yandex.com he sent it to megan bowen asking megan to review the updated contract and so megan's just a regular end user she's going to go ahead and open up that attachment now it's going to launch inside word and you can see here that the file is being verified by microsoft defender advanced through protection you can continue to read this file while we verify it well if i exit zoom here notice it immediately turns pink and if we look at it it says the file has been verified by microsoft defender atp and found to be malicious that is safe documents and action so what that means is if i try to save this look at this it is not available i cannot save it if i try to do something else like print it well notice all of the printing options are grayed out and i can't even enable printing export is grayed out i can't really do anything with this document other than just view it so that's safe documents in action pretty cool right so let me show you how to enable this and set it up on the back end okay so to enable this we're going to log into security.microsoft.com uh microsoft 365 defender and then over on the left side under email and collaboration we're going to click on policies and rules and go to threat policies and then scroll down and select safe attachments and then global settings under safe attachments and then we're going to turn on safe documents now notice i have the bottom one unchecked because i don't want my users to be able to click through it i want to make sure that they stay protected now this does require microsoft 365e5 or microsoft 365 e5 security add-on license so over in the admin portal here if we just look at my end user let's make sure that they have the appropriate license enabled for them and assigned licenses and apps and boom microsoft 365e5 is assigned perfect so now if we flip back here to the regular uh screen or sorry back to my test box rather if i just open up a regular document you will notice that it opens up just fine but if i go to open up a malicious document it scans it and then it turns pink now one way to go through and look to see how is this working in your environment is back inside microsoft 365 defender if we go to advanced hunting over the left side and run a query device events where action type contains safe doc file scan we will see a bunch of entries here now what's cool about this is if i scroll over on these entries all the way over to the right i can see no result no result clean boom malware so that's exactly where i can see where it found malicious content in that document now if i pull up that device and we take a look at the event logs for that device in the timeline view here we can see event vent of type safe dock file scan observed on device boom and then if i scroll through this a little bit more i could see some other things where word tried to establish a connection and some other stuff so pretty cool huh all right one last thing i want to show you is if we go back to our kql query here something that's really easy is i can write up this query and make a little bit more advanced to say anytime it finds malicious document here in the state or the verification result equals malware well then i can create an alert for that so i could just create a detection rule and then from there um go through and fill out some of the fields here so if we just put some garbage text here just so we can skip ahead to the next section choose a frequency i can tell anytime it impacts a device and then take an action on that device so maybe isolate it run an antivirus scan pull an investigation package maybe restrict app execution of synapse only and then it will also create an alert for me as well and then i can be notified about it so that's pretty cool okay so this is all about safe documents in microsoft 365. pretty easy to set up but very powerful once you do get it going okay folks give me a thumbs up if you found value in this hey if you didn't no problem at all be sure to subscribe because i have a lot more videos coming and we'll see in the next one take care