Incidents in Microsoft 365 Defender
Question
Microsoft 365 Defender gives a purpose based UI to manage and examine security incidents and alerts across Microsoft 365 services.
You are a SOC Analyst working at a company XYZ that has configured Microsoft 365 Defender solutions, including Defender for Endpoint, Defender for Identity, Defender for Office 365, and Cloud App Security.
You are required to monitor related alerts across all the solutions as single incident to observe the incident's full impact and do a RCA (root cause investigation)
The Microsoft Security centre portal has a fused view of incidents and actions taken on them.
Which of the following can be classified as an Incident?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.Correct Answer: B
Reference:
As a SOC Analyst, you are required to monitor related alerts across all the Microsoft 365 Defender solutions, including Defender for Endpoint, Defender for Identity, Defender for Office 365, and Cloud App Security, and classify them as incidents.
An incident in Microsoft 365 Defender can be defined as an event or a series of events that indicate a security breach or potential security breach. An incident can involve multiple alerts generated by different solutions, indicating that a security breach may have occurred, or it could be a single alert indicating that a security breach has occurred.
Out of the given options, the following can be classified as incidents:
B. True alert: A true alert is generated when a potential security threat is detected. This type of alert indicates that an actual security breach may have occurred or is about to occur.
C. High alert: A high alert is generated when a security threat is identified that requires immediate attention. This type of alert indicates that a security breach may have occurred or is about to occur and requires immediate investigation.
D. Positive alert: A positive alert is generated when a specific security policy is violated. This type of alert indicates that a security breach may have occurred or is about to occur and requires investigation.
A. Test alert: A test alert is generated during testing to ensure that the alerting system is working correctly. This type of alert does not indicate that a security breach has occurred and cannot be classified as an incident.
In summary, incidents in Microsoft 365 Defender are generated when potential or actual security breaches are detected, and they require investigation. True alerts, high alerts, and positive alerts can all be classified as incidents.
