Microsoft Cloud App Security – Release 179 & 180

Microsoft Cloud App Security – Release 179 & 180

• New anomaly detection: Suspicious OAuth app file download activities
  Microsoft has extended their anomaly detections to include suspicious download activities by an OAuth app. The new detection is now available out-of-the-box and automatically enabled to alert you when an OAuth app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.
• Performance improvements using proxy caching for Session Controls (gradual rollout)
  Microsoft has made additional performance improvements to their session controls, by improving their content caching mechanisms. The improved service is even more streamlined and provides increased responsiveness when using session controls. Note that session controls do not cache private content, aligning with the appropriate standards to only cache shared (public) content. For more information, see How session control works.
• New feature: Save security configuration queries
  Microsoft has added the ability to save queries for their security configuration dashboard filters for Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). This can help make future investigations even simpler by reusing common queries. Learn more about Security configuration recommendations.
• Enhanced anomaly detection alerts
  Microsoft has extended the information they provide for anomaly detection alerts to include a mapping to the corresponding MITRE ATT&CK tactic. This mapping will help you understand the phase and impact of the attack and assist with your investigations. Learn more about How to investigate anomaly detection alerts.
• Enhanced detection logic: Ransomware activity
  Microsoft has updated the detection logic for Ransomware activity to provide improved accuracy and reduced alert volume. For more information about this anomaly detection policy, see Ransomware activity.
• Identity Security Posture reports: Tags visibility
  Microsoft has added entity tags to Identity Security Posture reports providing additional insights about entities. For example, the Sensitive tag can help you identify risky users and prioritize your investigations. Learn more about Investigating risky users.