Forum Discussion

Microsoft

Mar 23, 2023

Ninja Cat Giveaway: Episode 7 | Defender for Identity and Defender for Endpoint: Better to together

For this episode, your opportunity to win a plush ninja cat is the following - Tell us about an alert that started either from Defender for Endpoint or Defender for Identity and what additional inf...

incident management

investigation

learning

microsoft defender for endpoint

threat hunting

Davis Veveris

Copper Contributor

Apr 05, 2023

An excellent case where information from both tools helped figure out what was going on for me was - MDI had a high severity alert for LDAP enumeration, and after examining the source system in MDE, we were able to identify the activity as bloodhound being run as the last stage of a red team penetration test.