title | description | search.appverid | ms.date | ms.service | ms.author | author | manager | ms.localizationpriority | audience | ms.topic | ms.collection | ms.custom | ||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Submit files in Microsoft Defender for Endpoint |
Learn how to use the unified submissions feature in Microsoft Defender XDR to submit suspicious emails, URLs, email attachments, and files to Microsoft for scanning. |
met150 |
05/06/2024 |
defender-endpoint |
siosulli |
siosulli |
deniseb |
medium |
ITPro |
how-to |
|
FPFN |
[!INCLUDE Microsoft Defender XDR rebranding]
Applies to
Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.
In Microsoft Defender for Endpoint, admins can use the unified submissions feature to submit files and file hashes (SHAs) to Microsoft for review. The unified submissions experience is a one-stop shop for submitting emails, URLs, email attachments, and files in one, easy-to-use submission experience. Admins can use the Microsoft Defender portal or the Microsoft Defender for Endpoint Alert page to submit suspicious files.
The new unified submissions experience is available only in subscriptions that include Microsoft Defender for Endpoint Plan 2. You need to assign permissions before you can perform the procedures in this article. Use one of the following options:
Microsoft Defender for Endpoint permissions:
- Submit files / file hashes: "Alerts investigation" or "Manage security settings in Security Center"
- View submissions: "View Data - Security operations"
Microsoft Defender XDR Unified RBAC permissions:
- Submit files / file hashes: "Alerts (Manage)" or "Core security settings (manage)"
- View submissions: "Security data basics (read)"
For more information about how you can submit spam, phish, URLs, and email attachments to Microsoft, see Use the Submissions page to submit suspected spam, phish, URLs, legitimate email getting blocked, and email attachments to Microsoft.
-
In the Microsoft Defender portal at https://security.microsoft.com, go to Actions & submissions > Submissions. Or, to go directly to the Submissions page, use https://security.microsoft.com/reportsubmission.
-
On the Submissions page, select the Files tab.
-
On the Files tab, select :::image type="icon" source="/defender/media/m365-cc-sc-create-icon.png" border="false"::: Add new submission.
:::image type="content" source="/defender/media/unified-admin-submission-new.png" alt-text="Screenshot showing how to add a new submission.":::
-
In the Submit items to Microsoft for review flyout that opens, select Files or File hash from the Select the submission type dropdown list.
-
If you selected Files, configure the following options:
- Select Browse files. In the dialog that opens, find and select the file, and then select Open. Repeat this step as many times as necessary. To remove an entry from the flyout, select :::image type="icon" source="/defender/media/m365-cc-sc-close-icon.png" border="false"::: next to the entry.
- The maximum total size of all files is 500 MB.
- Use the password 'infected' to encrypt archive files.
- The file should have been categorized as: Select one of the following values:
- Malware (false negative)
- Unwanted software
- Clean (false positive)
- Choose the priority: Select one of the following values:
- Low - bulk file or file hash submission
- Medium - standard submission
- High - needs immediate attention (max three per day)
- Notes for Microsoft (optional): Enter an optional note.
- Share feedback and relevant content with Microsoft: Read the privacy statement and then select this option.
:::image type="content" source="/defender/media/unified-admin-submission-file.png" alt-text="Screenshot showing how to submit files.":::
- Select Browse files. In the dialog that opens, find and select the file, and then select Open. Repeat this step as many times as necessary. To remove an entry from the flyout, select :::image type="icon" source="/defender/media/m365-cc-sc-close-icon.png" border="false"::: next to the entry.
-
If you selected File hash, configure the following options:
- In the empty box, enter the file hash value (for example,
2725eb73741e23a254404cc6b5a54d9511b9923be2045056075542ca1bfbf3fe
) and then press the ENTER key. Repeat this step as many times as necessary. To remove an entry from the flyout, select :::image type="icon" source="/defender/media/m365-cc-sc-close-icon.png" border="false"::: next to the entry. - The file should have been categorized as: Select one of the following values:
- Malware (false negative)
- Unwanted software
- Clean (false positive)
- Notes for Microsoft (optional): Enter an optional note.
- Share feedback and relevant content with Microsoft: Read the privacy statement and then select this option.
:::image type="content" source="/defender/media/unified-admin-submission-file-hash.png" alt-text="Screenshot showing how to submit files hashes.":::
- In the empty box, enter the file hash value (for example,
When you're finished in the Submit items to Microsoft for review flyout, select Submit.
-
Back on the Files tab of the Submissions page, the submission is shown.
To view the details of the submission, select the submission by clicking anywhere in the row other than the check box next to the Submission name. The details of the submission are in the details flyout that opens.
-
In the Microsoft Defender portal at https://security.microsoft.com, go to Incidents & alerts > Alerts. Or, to go directly to the Alerts page, use https://security.microsoft.com/alerts.
-
On the Alerts page, find the alert that contains the file you want to report. For example, you can select :::image type="icon" source="/defender/media/m365-cc-sc-filter-icon.png" border="false"::: Filter, and then select Service sources > Microsoft Defender for Endpoint.
-
Select the alert from the list by clicking anywhere in the row other than the check box next to the Alert name value.
-
In the details flyout that opens, select :::image type="icon" source="/defender/media/m365-cc-sc-more-actions-icon.png" border="false"::: > Submit items to Microsoft for review.
:::image type="content" source="/defender/media/unified-admin-submission-alerts-queue.png" alt-text="Screenshot showing how to submit items from an alerts queue.":::
-
The options that are available in the Submit items to Microsoft for review flyout that opens are basically same as described in the previous section.
The only difference is an Include alert story option that you can select to attach a JSON file that helps Microsoft investigate the submission.
:::image type="content" source="/defender/media/unified-admin-submission-alert-queue-flyout.png" alt-text="Screenshot showing how to specify a submission type and fill in required fields.":::
When you're finished in the Submit items to Microsoft for review flyout, select Submit.
The submission is available on the Files tab of the Submissions page at https://security.microsoft.com/reportsubmission?viewid=file.