Event banner
Event details
We see a lot of alerts with an actor......how can we figured out who or what is the actor.....shouldn't be there something like entity mapping f.e user, host or IP
- LiorShapira
Microsoft
Some of the network-based alerts don’t provide us with the actor because they only contain the IP from where the traffic was coming from but not the user. We are looking at ways to correlate events on the DC, but this doesn’t always present. If you have MDE, you can try using advanced hunting to correlate the endpoint data. In addition, you can investigate on the device page and make the correlation.
