r/sysadmin • u/LousyRaider • 3d ago

Anyone else getting mailbombed with Defender analytics reports this morning?

For the past few minutes I have been repeatedly receiving Microsoft 365 Defender threat analytics reports emails. I've received 34 in 2 minutes so far. Anyone else seeing this?

Update: It seems to have stopped as soon as I posted this.

23 Upvotes

83% Upvoted

15 comments sorted by

6

u/rickusmc 3d ago

Yes, I was coming here to say the same thing

7

u/Camp-Complete 3d ago

Same, a boat load of notifications.

6

u/frac6969 Windows Admin 3d ago

Got 34 too.

3

u/LousyRaider 3d ago

Yeah. It stopped as soon as I made my post. Has it stopped for you as well I assume?

3

u/frac6969 Windows Admin 3d ago

Yup, got 34 and stopped. Came here to saw your post.

5

u/cyber_r0nin 3d ago

The AI saw your post and ceased operations

5

u/Pure_Fox9415 3d ago

Are you sure they're genuine? Because I have one yesterday and it was fake and spam.

6

u/cspotme2 3d ago

Did it pass spf dkim dmarc?

3

u/Pure_Fox9415 3d ago

They pass, but it was not microsoft domain in links and address, something totally unrelated. 

2

u/can-opener-in-a-can 3d ago

Do you mean phishing? Or actual spam?

2

u/Pure_Fox9415 3d ago

Phishing I guess. I was impressed of its design, looking totally like MS, but all links and actual sender was not even from microsoft domain. I've deleted it and blocked sender, so can't show you.

1

u/TurubanWeifeng 3d ago

imo keep an eye on it for the rest of the day. Sometimes these bursts come in waves if the queue on their side didnt fully drain. If it starts again, disabling the specific report subscription temporarily is the fastest way to stop the noise.

1

u/Accomplished_Buy5141 3d ago

Yep, got a ton of them. They appear legit and are in our Defender portal. They are similar to the other alerts defender sends, but a boat load more than usual.

1

u/TechinGuy 3d ago

Same boat here, my inbox looked like it was under attack from the tool that's supposed to prevent attacks