Microsoft Security Tech Accelerator
Dec 06 2023, 07:00 AM - 12:00 PM (PST)
Microsoft Tech Community

PetitPotam - Defender For Identity Alert IDs

Copper Contributor

This blog indicates PetitPotam is now detected by Defender For Identity. But what is the corresponding Alert ID?


The Alert IDs have not been updated since October 2020:

6 Replies
The alert ID for PetitPotam alert is 2416.

Hi @Eli Ofek, thanks for the info. Please could you tell me the corresponding Cloud App Security ID for this? e.g. 2002 == ALERT_EXTERNAL_AATP_ABNORMAL_KERBEROS_OVERPASS_THE_HASH_SECURITY_ALERT


Hopefully the documentation could be updated to include Alert IDs 2412-2416.

I don' t know, but I pinged the relevant PM to check this out.
best response confirmed by RogerB1500 (Copper Contributor)
Refresh the docs page and let me know if you can find the missing id's now...
Perfect, thanks!