Skip to content

Commit a35001c

Browse files
Update sharepoint-malware-false-positive-guide.md
following corrections has been made. Corrections I found : - Step 1: Identify th engine that flagged the file - <<wrong link>> : The Files tab of the Tenant Allow/Block Lists page at https://security.microsoft.com/reportsubmission?viewid=emailAttachment. The correct link is https://security.microsoft.com/tenantAllowBlockList?viewid=FileHash - Defender for Endpoint signature detections (Microsoft Defender XDR or Microsoft Defender for Endpoint Plan 2): Submit a file for malware analysis using the Files tab on the Submissions page in the Defender portal at https://security.microsoft.com/reportsubmission?viewid=fileSubmissions. For instructions, see Submit files in Microsoft Defender for Endpoint. << The following is an alternative to the above and can be used when the tenant does not have Microsoft Defender XDR or Microsoft Defender for Endpoint Plan 2. We may need to word it accordingly.>> - Submit the file from the Microsoft Security Intelligence at https://www.microsoft.com/wdsi/filesubmission. <<Links repeated twice>> - I Think we can remove “Quarantine” from last segment as this >30 days scenario. The file path from the relevant source: o The SharePoint library details. o Quarantine. o Output from the Get-SPOMalwareFile cmdlet.
1 parent 82f3752 commit a35001c

1 file changed

Lines changed: 3 additions & 6 deletions

File tree

SharePoint/SharePointOnline/security/sharepoint-malware-false-positive-guide.md

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ Malware false positive detections in SharePoint occur when a safe file is mistak
2626
> - Admins or security operations (SecOps) personnel with [Security Administrator](/entra/identity/role-based-access-control/permissions-reference#security-administrator) permissions in organizations with cloud mailboxes have access files on the following pages in the Microsoft Defender portal:
2727
> - The **Files** tab of the **Quarantine** page at <https://security.microsoft.com/quarantine?viewid=Files>.
2828
> - The **Email Attachments** tab of the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=emailAttachment>.
29-
> - The **Files** tab of the **Tenant Allow/Block Lists** page at <https://security.microsoft.com/reportsubmission?viewid=emailAttachment>.
29+
> - The **Files** tab of the **Tenant Allow/Block Lists** page at <https://security.microsoft.com/tenantAllowBlockList?viewid=FileHash>.
3030
>
3131
> However, the **Files** tab on the **Submissions** page at <https://security.microsoft.com/reportsubmission?viewid=fileSubmissions> is available only to organizations with **Microsoft Defender XDR** or **Microsoft Defender for Endpoint Plan 2**.
3232
> - For permissions and the most current information about the SharePoint Online Management Shell, see [Intro to SharePoint Online Management Shell](/powershell/sharepoint/sharepoint-online/introduction-sharepoint-online-management-shell).
@@ -46,7 +46,7 @@ File scanning isn't always immediate. Scanning happens **asynchronously** based
4646

4747
Use the steps in these sections to deal with false positives in SharePoint.
4848

49-
### Step 1: Identify th engine that flagged the file
49+
### Step 1: Identify the engine that flagged the file
5050

5151
Use any of the following methods:
5252

@@ -114,9 +114,7 @@ If multiple files are flagged, submit all affected files by using the following
114114
2. Submit the files using one of the following methods based on how the file was detected:
115115
- **Safe Attachments detections**: Use the **Email attachments** tab on the **Submissions** page in the Defender portal at <https://security.microsoft.com/reportsubmission?viewid=emailAttachment>. For instructions, see [Report good email attachments to Microsoft](/defender-office-365/submissions-admin#report-good-email-attachments-to-microsoft).
116116

117-
- **Defender for Endpoint signature detections** (Microsoft Defender XDR or Microsoft Defender for Endpoint Plan 2): Submit a file for malware analysis using the **Files** tab on the **Submissions** page in the Defender portal at <https://security.microsoft.com/reportsubmission?viewid=fileSubmissions>. For instructions, see [Submit files in Microsoft Defender for Endpoint](/defender-endpoint/admin-submissions-mde).
118-
119-
- Submit the file from the [Microsoft Security Intelligence](https://www.microsoft.com/wdsi/filesubmission) portal at <https://www.microsoft.com/wdsi/filesubmission>.
117+
- **Defender for Endpoint signature detections** (Microsoft Defender XDR or Microsoft Defender for Endpoint Plan 2): Submit a file for malware analysis using the **Files** tab on the **Submissions** page in the Defender portal at <https://security.microsoft.com/reportsubmission?viewid=fileSubmissions>. For instructions, see [Submit files in Microsoft Defender for Endpoint](/defender-endpoint/admin-submissions-mde). Alertnatively, Submit the file through the **Microsoft Security Intelligence** portal at <https://www.microsoft.com/wdsi/filesubmission>.
120118

121119
### Step 3: Verify the outcome
122120

@@ -141,7 +139,6 @@ Use any of the following methods:
141139
> - The detection type.
142140
> - The file path from the relevant source:
143141
> - The SharePoint library details.
144-
> - Quarantine.
145142
> - Output from the [Get-SPOMalwareFile](/powershell/module/microsoft.online.sharepoint.powershell/get-spomalwarefile) cmdlet.
146143
>
147144
> Here's an example path from the SharePoint library details: <https://contoso.sharepoint.com/sites/Everyone/Shared%20Documents/General/MyDoc1.docx>

0 commit comments

Comments
 (0)