ATP policy status check

id: 518e6938-10ef-4165-af19-82f1287141bc
name: ATP policy status check
description: |
  This query displays the configuration auditing for 'Safe Attachments for SharePoint, OneDrive, and Microsoft Teams' and 'Safe Documents' in Microsoft Defender for Office 365.
description-detailed: |
  This query displays the configuration auditing for 'Safe Attachments for SharePoint, OneDrive, and Microsoft Teams' and 'Safe Documents' settings in Microsoft Defender for Office 365.
  Reference - https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-about
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - CloudAppEvents
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
  CloudAppEvents
  | where Application == "Microsoft Exchange Online"
  | where ActionType == "Set-AtpPolicyForO365"
  | mv-expand ActivityObjects
  | extend Name = tostring(ActivityObjects.Name)
  | extend Value = tostring(ActivityObjects.Value)
  | where Name in ("EnableATPForSPOTeamsODB", "EnableSafeDocs", "AllowSafeDocsOpen")
  | extend packed = pack(Name, Value)
  | summarize PackedInfo = make_bag(packed), ActionType = any(ActionType) by Timestamp, AccountDisplayName
  | evaluate bag_unpack(PackedInfo)
version: 1.0.0