Microsoft Defender for Office 365
Email and collaborationAttack Simulation Training Faq
In brief
The FAQ now explains that security tools can generate click telemetry during content inspection, recommends built-in simulation reports, and notes that Safe Links and UrlClickEvents may not capture all simulation activity.
What Defender admins need to know
Define exclusions for simulation messages in tools that inspect web content, and use the built-in simulation reports for activity reporting.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- Endpoint security or anti-virus software.
- Security orchestration, automation, and response (SOAR) playbooks that automatically triage or automatically respond to reported messages.
Outlook add-ins, email security tools, endpoint security software, and SOAR playbooksThese tools can inspect web content to detect phishing,phishing. This inspection can generate click telemetry even when the end user didn't manually click the link, so you need to define exclusions for simulation messages in those tools.
EmailLinkClicked_IP and EmailLinkClicked_TimeStamp data might give more details about the event. For example, if a click occurred a few seconds after delivery, and the IP address doesn't belong to Microsoft, your company, or the user, then it's likely that a non-Microsoft filtering system or another service intercepted the message.
For reporting on user activity related to simulation messages, we recommend using the built-in simulation reports. Reports from other sources (for example, Advanced hunting) might not be accurate.
Safe Links doesn't wrap simulation URLs, so the URLs are considered unwrapped links. Not all clicks on unwrapped links go through Safe Links, so user activity related to simulation messages might not be recorded in the UrlClickEvents logs.
For any non-Microsoft filtering systems or services, you need to allow or exempt the following items:
- All Attack simulation training URLs and the corresponding domains. Currently, we don't send simulation messages from a static list of IP addresses.
@@ -136,10 +136,14 @@ Unexpected clicks and compromise events can occur when other security devices or - Endpoint security or anti-virus software.
- Security orchestration, automation, and response (SOAR) playbooks that automatically triage or automatically respond to reported messages.
-Outlook add-ins, email security tools, endpoint security software, and SOAR playbooks can inspect web content to detect phishing, so you need to define exclusions for simulation messages in those tools.
+These tools can inspect web content to detect phishing. This inspection can generate click telemetry even when the end user didn't manually click the link, so you need to define exclusions for simulation messages in those tools.
EmailLinkClicked\_IP and EmailLinkClicked\_TimeStamp data might give more details about the event. For example, if a click occurred a few seconds after delivery, and the IP address doesn't belong to Microsoft, your company, or the user, then it's likely that a non-Microsoft filtering system or another service intercepted the message.
+For reporting on user activity related to simulation messages, we recommend using the [built-in simulation reports](attack-simulation-training-insights). Reports from other sources (for example, [Advanced hunting](/en-us/defender-xdr/advanced-hunting-overview)) might not be accurate.
+
+Safe Links doesn't wrap simulation URLs, so the URLs are considered unwrapped links. Not all clicks on unwrapped links go through Safe Links, so user activity related to simulation messages might not be recorded in the [UrlClickEvents logs](/en-us/defender-xdr/advanced-hunting-urlclickevents-table).
+
For any non-Microsoft filtering systems or services, you need to allow or exempt the following items:
- All [Attack simulation training URLs](attack-simulation-training-get-started#simulations) and the corresponding domains. Currently, we don't send simulation messages from a static list of IP addresses.