{ "description": "Event contains one or more entries of known microsoft domains", "list": [ ".aadrm.cn", ".aadrm.com", ".aadrm.us", ".acompli.net", ".admin.onedrive.us", ".afx.ms", ".aka.ms", ".akadns.net", ".aspnetcdn.com", ".assets-yammer.com", ".assets.onestore.ms", ".attachments-dod.office365-net.us", ".attachments.office365-net.cn", ".attachments.office365-net.us", ".auth.microsoft.cn", ".auth.microsoft.us", ".autodiscover-s-dod.office365.us", ".autodiscover-s.office365.us", ".autodiscover.*.mail.onmicrosoft.com", ".autodiscover.*.mail.onmicrosoft.us", ".autodiscover.*.onmicrosoft.com", ".autodiscover.*.onmicrosoft.us", ".autologon.microsoftazuread-sso.com", ".azure-int.net", ".azure-mobile.cn", ".azure-mobile.net", ".azure.com", ".azure.net", ".azureedge.net", ".azurerms.com", ".azurewebsites.net", ".bing-exp.com", ".bing-int.com", ".bing.com", ".bing.net", ".ceipmsn.com", ".chinacloud-mobile.cn", ".chinacloudapi.cn", ".cloud.microsoft", ".cloudapp.azure.com", ".cloudapp.azure.net", ".cloudapp.net", ".codeplex.com", ".collector.azure.cn", ".compliance.microsoft.us", ".cortana.ai", ".discoverbing.com", ".dod-graph.microsoft.us", ".dod-mtis.cortana.ai", ".dod.activity.windows.us", ".dod.loki.office365.us", ".dod.online.office365.us", ".dod.teams.microsoft.us", ".eus-www.sway-cdn.com", ".eus-www.sway-extensions.com", ".files-df.1drv.com", ".files.1drv.com", ".firstpartyapps.oaspapps.com", ".gcc-high.activity.windows.us", ".gcch-mtis.cortana.ai", ".gcchigh.loki.office365.us", ".getmicrosoftkey.com", ".gfx-int.ms", ".gfx.ms", ".gov.online.office365.us", ".gov.teams.microsoft.us", ".graph.microsoft.us", ".graph.microsoftazure.us", ".healthvault-ppe.co.uk", ".healthvault-ppe.com", ".healthvault.co.uk", ".healthvault.com", ".hotmail-int.com", ".hotmail.com", ".informationprotection.azure.us", ".live-int.com", ".live-int.net", ".live-partner.com", ".live-ppe.net", ".live.com", ".live.fi", ".live.net", ".livefilestore-int.com", ".livefilestore.com", ".livemeeting.com", ".login.microsoftonline.us", ".login.partner.microsoftonline.cn", ".login.windows-ppe.net", ".loki.office365.cn", ".lync.com", ".mail.protection.partner.outlook.cn", ".manage.office365.us", ".mesh.com", ".mgmt.live", ".microsoft-int.com", ".microsoft.com", ".microsoft.com.au", ".microsoft.com.tr", ".microsoft.fr", ".microsoftgraph.chinacloudapi.cn", ".microsoftonline-int.com", ".microsoftonline-p-int.com", ".microsoftonline-p.com", ".microsoftonline-p.net", ".microsoftonline.cn", ".microsoftonline.com", ".microsoftonline.net", ".microsoftprime.com", ".microsoftstore.com", ".microsoftstore.com.br", ".microsoftstore.com.cn", ".microsoftstore.com.hk", ".microsofttranslator.com", ".microsoftusercontent.com", ".microsoftvirtualacademy.com", ".modern.ie", ".msads.net", ".msauth.cn", ".msauth.net", ".msauthimages.cn", ".msauthimages.net", ".msauthimages.us", ".msecnd.net", ".msftauth.cn", ".msftauth.net", ".msftauthimages.cn", ".msftauthimages.net", ".msftauthimages.us", ".msftidentity.com", ".msgamestudios.com", ".msidentity.com", ".msn-int.com", ".msn.cn", ".msn.co.jp", ".msn.com", ".msn.com.cn", ".msocdn.com", ".msteamsstatics.blob.core.usgovcloudapi.net", ".mx.microsoft", ".o365weve.com", ".ocos-office365-s2s.msedge.net", ".ocsp.msocsp.com", ".office-int.com", ".office-int.net", ".office.com", ".office.net", ".office365.com", ".office365.us", ".officehome.msocdn.us", ".officeppe.com", ".officeppe.net", ".officewebapps.cn", ".onedrive.com", ".onenote.com", ".onenote.net", ".onmicrosoft.com", ".onmschina.cn", ".osi.office365.us", ".outlook-dod.office365.us", ".outlook.cloud.microsoft", ".outlook.com", ".outlook.office365.us", ".outlookmobile.com", ".partner.microsoftonline-m-i.net.cn", ".partner.microsoftonline-m.net.cn", ".partner.microsoftonline-p.cn", ".partner.microsoftonline-p.net.cn", ".partner.microsoftonline.cn", ".partner.office365.cn", ".partner.officewebapps.cn", ".partner.outlook.cn", ".pfx.ms", ".phonefactor.net", ".platform.linkedin.com", ".portal.cloudappsecurity.com", ".powerapps.com", ".powerautomate.com", ".protection.office365.us", ".protection.partner.outlook.cn", ".purview.microsoft.us", ".r4.partner.outlook.cn", ".redmond.corp.microsoft.com", ".s-microsoft.com", ".s-msft.com", ".s-msn.com", ".scc.office365.us", ".security.microsoft.us", ".sfx-df.ms", ".sfx-int.ms", ".sfx.ms", ".sharepoint-mil.us", ".sharepoint.cn", ".sharepoint.com", ".sharepoint.us", ".sharepointonline.com", ".skype.com", ".skype.net", ".skypeassets.com", ".sovcloud-identity.de", ".sovcloud-mx.cn", ".sovcloud-sharepoint.de", ".sovcloud-static.cn", ".sovcloud-static.de", ".sovcloud-usercontent.cn", ".sovcloud-usercontent.de", ".sovcloud.cn", ".sovcloud.de", ".sqlazurelabs.com", ".static.microsoft", ".surface.com", ".svc.ms", ".sway.com", ".syncxp.net", ".tasks.office365.us", ".teams.cloud.microsoft", ".teams.microsoftonline.cn", ".trouter.io", ".usercontent.microsoft", ".usgovcloud-mx.microsoft", ".usgovcloud-static.microsoft", ".usgovcloud-usercontent.microsoft", ".usgovcloud.microsoft", ".virtualearth.net", ".visualstudio.com", ".vo.msecnd.net", ".webshell.dodsuite.office365.us", ".windows-int.net", ".windows.com", ".windows.net", ".windowsazure.cn", ".windowsazure.com", ".windowsmedia.com", ".windowsphone-int.com", ".windowsphone-int.net", ".windowsphone.com", ".windowsphone.net", ".windowssearch.com", ".windowsstore.com", ".windowsupdate.com", ".wlxrs.com", ".wus-www.sway-cdn.com", ".wus-www.sway-extensions.com", ".www.microsoft365.com", ".www.office365.us", ".www.sway.com", ".xbox.com", ".xboxlive.com", ".yammer.com", ".yammerusercontent.com", ".zune.net", "003-1-d.outlook.com", "003-1-d.prod.outlook.com", "azdns-migration-ns-validation.cn", "azure-api.net", "azure-apim.net", "azure-devices.net", "azure-mobile.net", "azure.com", "azurebiganalytics.net", "azuredatacatalog.com", "azuredatalake.net", "azuredatalakeanalytics.net", "azuredatalakestore.net", "azureedge.net", "azurehdinsight-stage.net", "azurehdinsight.net", "azurewebsites.net", "bing.com", "cloudapp-int.net", "cloudapp-preview.com", "cloudapp-preview.net", "cloudapp.net", "clouddatahub.net", "cloudwebappproxy.net", "community-stage.skype.com", "download.cortana.cn.bing.com", "download.microsoft.com", "gfx-int.ms", "hdinsightservices.net", "healthvault-ppe.com", "homeserver.com", "hotmail.co.uk", "hotmail.com", "iespdytst", "iespdytst.redmond.corp.microsoft.com", "ieta-wa-24", "insidersurveys.windows.com", "live.fi", "management-azure-devices.net", "mgmt-azure-api.net", "microsoft.com", "microsoftcrmportals.com", "microsoftcrmportalstest.com", "microsoftkonacompute.net", "microsoftprojecttokyo.com", "microsoftstream.com", "modern.ie", "msappproxy.net", "o365apps.net", "office-int.com", "office.com", "onedrive.com", "onenote.com", "outlook-int.com", "outlook.com", "pbiwebcontent.com", "pod71084-pri.outlook.com", "pod71084.outlook.com", "powerbi.com", "powerusers-staging.microsoft.com", "powerusers.microsoft.com", "remotewebaccess.com", "stage-azurewebsites.net", "stage-o365apps.net", "telecommand.telemetry.microsoft.com", "visualstudio.com", "vortex-sandbox.data.microsoft.com", "vsallin.net", "vsassets.io", "watson.telemetry.microsoft.com", "www.insidersurveys.windows.com", "za.microsoftstore.com" ], "matching_attributes": [ "domain", "hostname", "domain|ip", "url" ], "name": "List of known microsoft domains", "type": "string", "version": 20260908 }