DNS Reconnaissance activity not getting logged

[Karthik1600]

Hi,

I have successfully deployed the ATP Sensors on my environment today. I am trying to test the setup using the Reconnaissance Playbook but unfortunately, I am not receiving any alerts pertaining to Reconnaissance (Network-mapping or Directory-services).

When I read through to the document, it says that the Azure ATP suppresses the alerts from the suspicious activity log for a learning period of 8 days (Network-mapping) and 30 days (Directory-services), post which, the portal would start invoking those alerts that it suppressed. But in my case, I do not find any Reconnaissance alerts getting either suppressed or even generated at all (I checked on both the general timeline and source user/machine timeline).

Hence wanted to check, if there is something that I am missing or should I wait for a period of minimum 8 days to start my testing.

FYI, I tested the Honeytoken account activity and I received the alert for the same on the Azure ATP console while accessing my PC using that Honeytoken account.

Thank you.

[#2]

@Karthik1600 

Hi Karthik,

This seems to be a common issue

https://techcommunity.microsoft.com/t5/Azure-Advanced-Threat-Protection/DNS-reconnnaissance-tests-ca...

[#3]

@Karthik1600 ,

DNS Reconnaissance alert require learning period of 8 days.

Therefore no alert will be triggered during 8 days after the deployment.

Thanks,

Tali

[#4]

@Tali Ash 

Hi Tali,

Thank you for the response. I will test the setup post 8 days of learning period.

--

Regards,

Karthik