تحرير

How to report false positives/negatives in automated investigation and response capabilities

Tip

Did you know you can try the features in Microsoft Defender XDR for Office 365 Plan 2 for free? Use the 90-day Defender for Office 365 trial at the Microsoft Defender portal trials hub. Learn about who can sign up and trial terms here.

If automated investigation and response (AIR) capabilities in Office 365 missed or wrongly detected something, there are steps your security operations team can take to fix it. Such actions include:

Use this article as a guide.

Report a false positive/negative to Microsoft for analysis

If AIR in Microsoft Defender for Office 365 missed an email message, an email attachment, a URL in an email message, or a URL in an Office file, you can submit suspected spam, phish, URLs, and files to Microsoft for Office 365 scanning.

You can also Submit a file to Microsoft for malware analysis.

Adjust an alert to prevent false positives from recurring

If an alert is triggered by legitimate use, or the alert is inaccurate, you can Manage alerts in the Defender for Cloud Apps portal.

If your organization is using Microsoft Defender for Endpoint in addition to Office 365, and a file, IP address, URL, or domain is treated as malware on a device, even though it's safe, you can create a custom indicator with an "Allow" action for your device.

Undo a remediation action

In most cases, if a remediation action was taken on an email message, email attachment, or URL, and the item is actually not a threat, your security operations team can undo the remediation action and take steps to prevent the false positive from recurring. You can either use Threat Explorer or the Actions tab for an investigation to undo an action.

Important

Make sure you have the necessary permissions before attempting to perform the following tasks.

Undo an action using Threat Explorer

With Threat Explorer, your security operations team can find an email affected by an action and potentially undo the action.

Scenario Undo Options Learn more
An email message was routed to a user's Junk Email folder
  • Move the message to the user's Deleted Items folder
  • Move the message to the user's Inbox
  • Delete the message
 Find and investigate malicious email that was delivered in Office 365
An email message or a file was quarantined
  • Release the email or file
  • Delete the email or file
 Manage quarantined messages as an admin

Undo an action in the Action center

In the Action center, you can see remediation actions that were taken and potentially undo the action.

  1. In the Microsoft Defender portal at https://security.microsoft.com, go to the Action center by selecting Action center. To go directly to the Action center, use https://security.microsoft.com/action-center/.
  2. In the Action center, select the History tab to view the list of completed actions.
  3. Select an item. Its flyout pane opens.
  4. In the flyout pane, select Undo. (Only actions that can be undone will have an Undo button.)

See also