Forum Discussion
MDATP and Incident Handling
HeikeRitter Hmm.. How about this senario:
So say for example you have 150 offices world wide, and you get a Incident in MDATP containing 20 computers.
The type of malware requires additional actions to be taken by local IT per office.
You now dispatch 20 tickets containing the recommended actions, one for each office per computer.
If the ATP Incident now contains all these 20 computers, referring to the ATP Incident would be messy. As you get partial ATP Incident completion when the local tickets gets resolved.
I guess you could dispatch tickets based on alerts instead, but then again, you could have several alerts per computer. That again makes Incidents containing one machine a better reference.
I'm curious to what MS sees as best practice here.
Hope that made some sense and that I managed to explain the scenario (⌐■_■)
Maximilian Grandahl LærumI understand your point, however you would loose the benefit of a better overview of an incident if it was per machine based.
Some/most attacks would quickly growth to include multiple machines since the attacker would pivot between target hosts and response coordination is very important to be able to respond to the attack.
Therefor I believe it's important to have all information, including involved machines, tied in the incident since an critical incident would need central coordination.
I believe you can address your challenge with automation to automatically dispatch some of the alerts to the local IT depending on severity.
