Blog Post

Security, Compliance, and Identity Blog
3 MIN READ

Introducing Investigation Priority built on User and Entity Behavior Analytics

Jason Wilson's avatar
Jason Wilson
Icon for Microsoft rankMicrosoft
Mar 06, 2019
This post is authored by Itay Argoety, Product Manager, Azure ATP   Enterprise security operations (SecOps) often have limited resources and staff, and security analysts face evolving, more sophi...
Updated May 11, 2021
Version 5.0
microsoft defender for identity
SocInABox's avatar
SocInABox
Iron Contributor
Mar 07, 2021

Hi Jason Wilson or David Caddick ,

 

I'd like this to be useful in Sentinel as your article suggest is will be (in the future?).

 

For Sentinel I would need 1 or 2 things:

- The ability to create an MCAS alert based on Priority Score - I can't find a way to do this.

- The ability to create a KQL query in Sentinel that matches/simulates the Priority Score - I don't know what that query would look like.

 

Suggestions?