Hi Everyone,
Need your expert advise on blocking phishing mail sender id at defender portal in block list.
To achieve this, we have created a playbook for phishing mail and as a result we want to block the sender mail ID in defender allow/block list, we have integrated defender using defender application from app exchange. but we are not able to achieve as we could not find any function related to blocking sender mail id, file hash, file name in defender allow/block list.
from somewhere we got information that defender accept blocking using power shell script not through API, is that correct?
Could anyone help on this to achieve this using SOAR playbook or do we have any other way of achieving the same.
Thanks in advance!
Regards,
------------------------------
Veer Singh
------------------------------