Forum Discussion
Solved
Investigation Status - Unsupported Alert Type from MDCA
What does in mean when an alert from MDCA shows up as an Unsupported Alert Type
- Hi Dean, this means that our AutoIR can't pick-up the alert to do an automated investigation. For some alerts we don't have a playbook (yet)
6 Replies
- HeikeRitter
Microsoft
Hi Dean, this means that our AutoIR can't pick-up the alert to do an automated investigation. For some alerts we don't have a playbook (yet)Hi, is there any playbook for this yet?
What does it mean when an alert from MDE shows up as an Unsupported Alert TypeHeikeRitter Hi Ms Ritter
Silly question.
Does that mean the AutoIR capability works in general but just doesnt work for any IPs indicated in IOCs?
- HeikeRitterThere is no such things as silly questions! 🙂
No, it means it can't handle certain alert TYPES, but it doesn't mean that it can't investigate and remediate IP related alerts.
- thanks, it would be helpful if that was documented somewhere.
- HeikeRitterThanks Dean; I've requested that update to the doc page and it will be added. Thanks again!
