Event banner
Event details
How does MDI correlate with the Sentinel Insecure Protocol workbook? For example if i enable all the audit settings that are mentioned in the Secure Protocols workbook will I able to track and report on those protocols straight out of MDI or will I still need to spin up a Sentinel instance.
While there is no immediate correlation for MDI with that specific Sentinel workbook, MDI has various security assessments, including detection of NTLMv1 and LDAP Simple Bind activities that is also used on that workbook, you can find them all in Microsoft Secure Score feature at the Microsoft 365 Defender portal (Filter for Defender for identity)
- Does that have a requirement for that requisite auditing to be enabled as with the Sentinel Workbook.. I have a customer who has required to be able to report on things such as PlainText LDAP etc. but is const sensitive especially w.r.t Sentinel
- Yes, a couple of non default audit configurations on the DCs are required, see here https://docs.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection