Threats
The Threats page shows real-world attacks on Microsoft 365 tenants, such as account takeover, credential theft and phishing, and how well your settings block each step of them.
Instead of reading a threat report and wondering “are we exposed?”, you see the answer for your tenant.
The Threats List
Section titled “The Threats List”Each threat card shows the threat’s name and ID, how much of it is mitigated, and three counts: Stages, Recs (related recommendations) and Not reviewed. Compact and Large change the card size.
Sort the list by:
- Most recommendations: the threats with the most related checks (the default)
- Least mitigated: the threats you are most exposed to, first
- Newest: the latest threats added by Griffin31
- Name
Search threats by name, or use Filters:
| Filter | Shows |
|---|---|
| Mitigation | Fully mitigated, Partly mitigated, Not mitigated, or No results yet |
| Kill chain stage | Threats with a given attack stage |
| Threat actor | Threats tied to a given actor |
| Has a CVE | Threats tied to a published vulnerability |
Threat Details
Section titled “Threat Details”Select a threat to see:
| Section | What it shows |
|---|---|
| Title | The threat’s name, ID and a short description. See more shows all of it |
| Threat intel | The threat actors and activity behind it, the public Sources the threat is based on, and any CVEs |
| Attack path | The attack’s stages, following the MITRE ATT&CK kill chain. Each stage shows how many Griffin31 checks cover it; No checks means none do, often because the step happens outside your tenant. Click a stage to show only its recommendations |
| Mitigations | The recommendations that block each stage, with their state, ID, title, stage, scope and risk. Click a row to open the recommendation |
When you click a stage, Show all stages brings back the full list.
From Threat to Fix
Section titled “From Threat to Fix”- On the Recommendations page, the In threats box shows every recommendation that is part of a threat’s attack path.
- On the Dashboard, Fix these first lists the failing recommendations that show up in the most threats and stories. These usually give the most protection for the effort.