PetitPotam - Defender For Identity Alert IDs

[RogerB1500]

This blog indicates PetitPotam is now detected by Defender For Identity. But what is the corresponding Alert ID? 

https://techcommunity.microsoft.com/t5/security-compliance-and-identity/petitpotam-microsoft-defende...

The Alert IDs have not been updated since October 2020:

https://docs.microsoft.com/en-us/defender-for-identity/suspicious-activity-guide?tabs=cloud-app-secu...

[#2]

The alert ID for PetitPotam alert is 2416.

[#3]

Hi @EliOfek, thanks for the info. Please could you tell me the corresponding Cloud App Security ID for this? e.g. 2002 == ALERT_EXTERNAL_AATP_ABNORMAL_KERBEROS_OVERPASS_THE_HASH_SECURITY_ALERT

Hopefully the documentation could be updated to include Alert IDs 2412-2416.

https://docs.microsoft.com/en-us/defender-for-identity/suspicious-activity-guide?tabs=cloud-app-secu...

[#4]

I don' t know, but I pinged the relevant PM to check this out.

[#5]

Thanks

[#6 · Accepted solution]

Refresh the docs page and let me know if you can find the missing id's now...

[#7]

Perfect, thanks!