Forum Widgets
Latest Discussions
Defender Experts | Sentinel Automation based on Defender Experts Notifications (DENs)
Based on invaluable customer feedback, we're rolling out the first installment of our Defender Experts “cookbook”—a guide to enhance your experience with Sentinel automation based on Defender Experts Notifications (DENs). This customer-driven initiative reflects the importance our customers place on efficient SIEM automation to manage their operations effectively. This guide is a direct response to your insights. Think of it as a recipe book tailored to maximize the power of Defender Experts services. From optimizing DENs for automation to sharing pro tips, the guide is a collaborative effort to fortify our collective defense against evolving cyber threats. This collaborative effort reflects our commitment to transforming customer input into actionable solutions, with each new “recipe” empowering customers to navigate the complexities of the cybersecurity terrain with the confidence that Microsoft Defender Experts have their back. We encourage users to experiment with these insights and share their experiences, contributing to an ongoing dialogue that strengthens collective defenses against evolving cyber threats. Your success and protection against advanced threats is at the heart of our mission, and we look forward to continuing this collaborative journey together. Defender Experts | Sentinel Automation – NEW Defender Experts Notifications In order to configure automation rules based on NEW Defender Experts Notifications (DENs), follow the conditions below: Select Trigger When Incident is Created Select If Incident provider Equals Microsoft Defender XDR AND Select Title Contains Defender Experts Configure the relevant Actions you would like to enable based on the conditions selected above. For example, you can select a specific playbook to run or assign a particular owner to the Incident. Screenshot of Sentinel Automation Rule Trigger and Conditions based on NEW Incidents issued as DENs Defender Experts | Sentinel Automation – EXISTING Incidents that are upgraded to DENs In order to configure automation rules based on EXISTING Incidents that are upgraded to Defender Experts Notifications (DENs), follow the conditions below: Select Trigger When Incident is Updated Select If Incident provider Equals Microsoft Defender XDR AND Select Alerts Added AND Select Title Contains Defender Experts Configure the relevant Actions you would like to enable based on the conditions selected above. For example, you can select a specific playbook to run or assign a particular owner to the Incident. Screenshot of Sentinel Automation Rule Trigger and Conditions based on EXISTING Incidents Upgraded to DENsWelcome to the Microsoft Security Experts community!
We are thrilled to announce the launch of the Microsoft Security Experts community! Whether you’re familiar with our services or just starting to explore what we offer, you’ll find this community a collaborative space where you can freely ask questions and share insights with our team. We hope to engage in constructive dialogue that fosters growth and innovation and build a resourceful hub that benefits everyone. In addition to this community, we invite you to learn more about our services below and follow our blog for the latest news and insights: Microsoft Defender Experts for XDR Microsoft Defender Experts for Hunting Microsoft Incident Response Thank you for being a part of our community!
Unwanted Linked device
Hi 2 devices have access to my Microsoft account, sometimes when I log into my device it welcomes me as the other person vice versa. When we try creating a new alias on the other device it does not allow us (I don't even know what an alias is, all I know is it's in my name on another person's device) Sometimes I find the other device linked to mine, I keep removing the device however it keeps linking itself. Please help me because it turns out the other device has access to my cloud documents, regardless of whether I've logged in or not. I have to get this fixed within next 2 weeks otherwise I'm done for.Defender Experts in-depth - running a modern SOC in the age of LLMs
Did you miss the Defender Experts session held today (December 6, 2023) during the Microsoft Security Tech Accelerator event? See how our Defender Experts team runs a modern SOC and leverages LLMs and Copilots. You can catch the session on-demand here: https://aka.ms/Accelerate/ModernSOC
