Forum Widgets
Latest Discussions
AIR (Automated Investigation and Response) disables user in Active Directory, suspends in Entra ID
My organization saw an incident yesterday with a new-to-us behavior: Defender disabled the user access in Active Directory and suspended the user in Entra ID. It was an AitM (Attacker in the Middle) scenario, which we believe was delivered via phishing message and a shared OneDrive file. Defender correctly identified the malicious activity and disabled the account shortly after. I am curious because we have not seen this behavior before. Does anyone know if this is a new feature? Or possibly something that just hasn't hit our environment before (which seems unlikely)? I checked the following pages but didn't see anything that looked related: What's new in Microsoft Defender XDR What's new in Microsoft Defender for Identity What's new in Microsoft Defender for Endpoint I do see in security.microsoft.com under Settings - Microsoft Defender XDR -- Automation -- Identity automated response that we have the capability to exclude users from the automated response. It's possible this capability has been enabled for a while.
No Automated Investigation Triggered for High Severity Incident
Hi Community, I’ve noticed an issue where no Automated Investigation and Response (AIR) was invoked for a high-severity incident and alert on a device that belongs to a device group configured with full AIR. This behavior contradicts the expected principle of AIR, as outlined in the documentation: How Automated Investigation Starts. Details: The device is part of a group with full AIR enabled. A high-severity alert/incident occurred but did not trigger any automated investigation. Manual actions were required to address the threat, despite AIR being enabled. Questions: Has anyone experienced similar behavior where AIR is not triggered for eligible devices/incidents? Are there known scenarios or conditions that might prevent AIR from starting, even in fully configured groups? What steps can I take to troubleshoot or escalate this to ensure consistent AIR functionality? Your insights and suggestions would be greatly appreciated! Thank you.
Web content filtering and indicator aren't working on third party browser
Hi, we have just noticed that web content filtering and customized indicators are not working on third party browsers after upgraded defender for endpoint to 4.18.23050.3, the issue has happened to both Win10 and Win11 machines. Has anyone else got the same issue?MS Defender for Endpoint - List machines API
Is it possible to use below API to retrieve Machines with Onboarding status as 'Can be onboarded' ? We are hitting this API from ServiceNow & it seems that it is only returning Onboarded machines. https://api.security.microsoft.com/api/machines Reference: https://learn.microsoft.com/en-us/defender-endpoint/api/get-machines
WEB content filtering
Hello everyone, For a few days now, the “WEB content filtering” feature has not been performing its role of filtering web content by category, even though the rule is still in place and correctly configured. What surprises me is that this rule has been working for at least 2 years. I've deleted and re-created the rule several times, without success. Have you seen this behavior before? Do you know how to correct this problem?
Integration of Microsoft Defender into SIEM Open Source via Syslog
Hello everyone, I have: Microsoft Defender central console Endpoints reporting to central console SIEM open source I need to be able to export all logs from Microsoft Defender central console to SIEM via Syslog. Could someone provide me with a guide or step by step configuration? Thanks in advance!
Defender for Linux clients?
Hi all, I wonder if someone could help answering this one as I can't get proper help from my organisation on this. I am a Ubuntu client platform developer in Sweden at a university and we wish to use MS Defender on Ubuntu desktop clients, but there seems to be very unclear here about the license regarding where this Defender is allowed to be run. We have it on our Windows and Mac clients today. We have a Defender package for Linux server, but can we run it? Our Windows team says it is only for Linux server and the Linux clients are excluded from the same license level as Windows and Mac clients reside on. I tried searching the internet on this, but there is none to find it seems. Please help
