Join our Newsletter — 33% off our NHI Course

Threat Explorer

Threat Explorer is a security investigation tool for reviewing and analysing detected threats, messages, URLs and malware activity. It is used to inspect evidence, trace delivery paths and identify affected users or mailboxes so defenders can contain phishing, spam and malicious content.

What Threat Explorer Does

Threat Explorer is a security investigation console for reviewing detected threats, suspicious messages, malicious URLs and malware activity. Its value is not just display, but correlation, helping analysts inspect evidence, trace delivery paths and understand which users or mailboxes were touched.

That makes it a triage and investigation tool rather than a prevention control. It helps defenders move from alert to context by showing how a threat entered, what it interacted with, and where containment work should start.

How Analysts Use It in Investigation Workflows

Threat Explorer is most useful when the first question is, “What actually happened here?” Analysts use it to pivot from a detected item to related messages, URLs or payloads, then follow the chain of delivery and exposure. In mail-centered incidents, that often means identifying who received the content, which mailboxes saw it, and whether the same lure was reused across multiple messages.

Because the tool is built for investigation, it supports fast narrowing of scope. Instead of treating each alert as isolated, it helps teams connect indicators into a coherent incident picture and decide whether the event is a single delivery attempt or part of a broader campaign.

What It Reveals About Exposure and Scope

Threat Explorer can surface the practical footprint of a malicious campaign, including affected users, affected mailboxes and the delivery methods used by the attacker. That matters because the security question is rarely only “was something blocked?” It is also “who saw it, who clicked it, and what evidence remains to support containment and review?”

For phishing and spam investigations, that visibility helps distinguish nuisance traffic from active compromise paths. For malware-related activity, it can help defenders understand whether a message only delivered a link or whether follow-on activity suggests a deeper intrusion path.

How It Supports Containment and Follow-Up

Once investigators identify the suspicious item, the next step is usually containment: stop further delivery, isolate affected mailboxes or users, and review whether related messages or URLs are still circulating. Threat Explorer supports that response by making the threat lineage visible enough to guide cleanup and escalation.

It also helps with post-incident review. If a threat was delivered before detection, teams can use the tool to check for missed copies, confirm who was exposed, and decide whether additional user notification, mailbox review or malware investigation is needed. When paired with broader threat intelligence, it becomes part of the evidence trail rather than just a search interface.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
CIS Controls v8 CIS-8 — Audit Log Management Threat Explorer relies on retained telemetry and investigative evidence to trace suspicious activity.
Recommendation — Centralise alert and message telemetry so investigators can reconstruct delivery paths and scope quickly.
NIST CSF 2.0 DE.CM-01 — Anomalies and events are detected Threat Explorer is used to review detected events and follow suspicious content through the environment.
Recommendation — Use detection telemetry to surface suspicious messages, URLs and malware activity for analyst review.
MITRE ATT&CK T1204 — User Execution Threat Explorer helps trace phishing and malicious content delivered to users before interaction occurs.
Recommendation — Map suspicious content to user-execution pathways and investigate the delivery chain that exposed recipients.
OWASP API Security Top 10 API9 — Improper Inventory Management Threat Explorer depends on accurate inventory of messages, URLs and affected mailboxes for complete investigation.
Recommendation — Maintain accurate inventory of investigated content so analysts can scope exposure and verify cleanup.
NIST SP 800-53 Rev 5 AU-6 — Audit Record Review, Analysis, and Reporting Investigation tools are useful when analysts can review and correlate records to understand threat activity.
Recommendation — Review and correlate audit evidence to identify affected users, delivery paths and malicious content.