Mitigate threats using Microsoft 365 Defender

Question 1

is an integrated threat protection suite with solutions that detect malicious activity across email, endpoints, applications, and identity.

Answer 1

Microsoft 365 Defender

Question 2

Extended Detection and Response (XDR) combines signals from:

Answer 2

endpoints
identity
email
applications

Question 3

Near real-time resolution of known incident types with automation. These are well-defined attacks that the organization has seen many times.

Answer 3

Automation

Question 4

–Triage analysts focus on rapid remediation of a high volume of well-known incident types that still require (quick) human judgment. These are often tasked with approving automated remediation workflows and identifying anything anomalous or interesting that warrant escalation or consultation with investigation (Tier 2) teams.

Answer 4

Triage (aka Tier 1)

Question 5

We recommend setting a quality standard of 90% true positive for any alert feeds that will require an analyst to respond so analysts aren’t required to respond to a high volume of false alarms.

Answer 5

90% true positive