XDR Incidents Flashcards
What are MS defender XDR indcidents based on?
Incidents are based on related alerts created when a malicious event or activity is seen on the network
How do MS defender XDR collect alerts to create an incident?
An incident is a collection of correlated alerts that make up the story of an attack. Microsoft Defender XDR automatically aggregates malicious and suspicious events that are found in different device, user, and mailbox entities in the network.
Which security framework is MS defender XDR aligned to?
MITRE ATT&CK framework
What type of activities could trigger high (red) alerts in MS Defender XDR?
Credential theft tools activities, ransomware activities not associated with any group, tampering with security sensors, or any malicious activities indicative of a human adversary.
What type of activities could trigger Medium (Orange) alerts in MS Defender XDR?
Activities that could be a part of an APT, observed behaviors typical of attack stages, anomalous registry change, execution of suspicious files, and so forth. Although some might be part of internal security testing, it requires investigation as it might also be a part of an advanced attack.
What type of activities could trigger Low (yellow) alerts in MS defender XDR?
Activities that could be associated with prevalent malware.
E.g hack-tools, non-malware hack tools, or security testing from legitimate activties.
An unauthorized User used RDP to gain access to a single host and from there moves to other hosts in network, what alert category is triggered in the Defender XDR platform?
Lateral movement - Moving between devices in the target network to reach critical resources or gain network persistence
When creating a suppression rule in defender for endpoint, which alerts is the rule applied for?
It will ONLY be applied to alerts that satisfy the conditions set AFTER the rule is created.
What are the automation levels in the Defender for endpoint platform?
- Non protected
- Semi- require approval for any remediation
- Semi- require approval for non-temp folders
- Semi- require approval for Core folders
- Full – Remediate threats automatically
