Share via

How to generate sample events for Microsoft Defender Threat Intelligence?

Swarada Jalukar 0 Reputation points
2025-08-25T12:51:55.8466667+00:00

Hi team,

I am working on exploring about MS Threat Intelligence. But I am not aware how to generate test data for this product?

I am already on Defender Plan, which supports threat intelligence, but wish to explore about the Threat Intelligence logs using Microsoft Management API following the schema - https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#auditlogrecordtype

Can someone help me in knowing how to generate some sample events for this service and how they get collected?

Microsoft 365 and Office | Development | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jayden-P 6,210 Reputation points Microsoft External Staff Moderator
    2025-08-25T13:54:57.7533333+00:00

    Hi @Swarada Jalukar

    Thank you for posting your question in the Microsoft Q&A forum.

    To generate sample events for Threat Intelligence in Microsoft Defender for Office 365, you can simulate detections in a controlled manner. These simulations trigger the protection mechanisms, resulting in logs that appear as Threat Intelligence records.

    Note: Always conduct testing in a non-production environment or with test accounts to avoid disrupting real users.

    Two primary methods to generate events: phishing simulations and malware testing. These will produce logs viewable in the Microsoft Defender portal.

    1. Simulate Phishing Events for AuditLogRecordType 28 Phish or 41 Safe Links Use the built-in Attack simulation training feature in the Microsoft Defender portal. This sends realistic phishing emails to targeted users, triggering detections and logging user interactions.
    2. Simulate Malware Events for AuditLogRecordType 28 Malware Send an email with the EICAR test file attached. EICAR is a harmless string recognized by antivirus engines as a test "virus," allowing safe testing without real malware. Defender for Office 365 will detect, quarantine, and log it.

    To stimulate an attack, please follow the steps in this article:

    Simulate a phishing attack with Attack simulation training - Microsoft Defender for Office 365 | Microsoft Learn

    You can check events in the Defender portal's Threat Explorer (Email & collaboration > Explorer) for real-time views of phish/malware data.

    I hope this information helps.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    User's image

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.