Forum Discussion

Paragon06's avatar
Paragon06
Copper Contributor
Sep 13, 2022

Defender365 Alerts for high volume file deletion

All of a sudden we're getting large volumes of alerts from Defender for unusual volume of file deletions. We seldom get these and when we do it has previously turned out to be a user clearing old fil...
admin
Reports
Paragon06's avatar
Paragon06
Copper Contributor
Sep 22, 2022

Hussayn We do have defender and compliance intergration. 

 

Our case has been passed on to a back end team but i've not heard anything in a few days. Once I do, i'll post the outcome. 

 

Cheers

Jamie

Hussayn's avatar
Hussayn
Copper Contributor
Sep 23, 2022

Paragon06 

Thanks for sharing, the only reason I was asking is I guess this is how the compliance tool and therefore the alerting rule knows about files being 'deleted' within the users' local profiles - the Defender telemetry, plus its only something I enabled in our environment around the the time (9th Sept). I suspect you and others have had this intergration running for some time.

 

I too was told by the first support rep after they spoke with their TL, this is how it is, just set a limit on the email notification to reduce the notification, but I pushed back and its been reassigned to someone else.


Thanks

  • Ed_Carmody's avatar
    Ed_Carmody
    Copper Contributor
    Oct 09, 2022
    We enabled the Intune profile Intune data collection policy / Device Configuration Profiles - Windows health monitoring and set Health monitoring Enable / Scope Endpoint analytics. It looks like this is triggering the same behavior with Inet and Windows search cache being deleted.
    • Paragon06's avatar
      Paragon06
      Copper Contributor
      Oct 10, 2022

      Ed_Carmody 

       

      Thanks for this, this makes sense now as I enabled the intune data collection policy a few weeks back. 

       

      Kind Regards

      Jamie

Resources