Forum Discussion
Solved
PetitPotam - Defender For Identity Alert IDs
This blog indicates PetitPotam is now detected by Defender For Identity. But what is the corresponding Alert ID?
The Alert IDs have not been updated since October 2020:
https://docs.microsoft.com/en-us/defender-for-identity/suspicious-activity-guide?tabs=cloud-app-security#security-alert-name-mapping-and-unique-external-ids
- Refresh the docs page and let me know if you can find the missing id's now...
6 Replies
- EliOfek
Microsoft
The alert ID for PetitPotam alert is 2416.Hi EliOfek, thanks for the info. Please could you tell me the corresponding Cloud App Security ID for this? e.g. 2002 == ALERT_EXTERNAL_AATP_ABNORMAL_KERBEROS_OVERPASS_THE_HASH_SECURITY_ALERT
Hopefully the documentation could be updated to include Alert IDs 2412-2416.
https://docs.microsoft.com/en-us/defender-for-identity/suspicious-activity-guide?tabs=cloud-app-security#security-alert-name-mapping-and-unique-external-ids
- EliOfekI don' t know, but I pinged the relevant PM to check this out.
