Forum Discussion

HeikeRitter's avatar
HeikeRitter
Icon for Microsoft rankMicrosoft
Mar 30, 2023

Ninja Cat Giveaway: Episode 10 | Identity Threat Detection and Response

For this episode, your opportunity to win a plush ninja cat is the following – Our season finishes here! After learning about this last topic, tell us your thoughts on the Microsoft 365 Defender ap...
Incident Management
investigation
learning
Response Actions
siem
  • MSTechie's avatar
    MSTechie
    Apr 03, 2023
    My favourite quote of the session was "securing identities is a team sport", I love how Microsoft is encouraging organisations to ensure the identity team and SOC team work together as one to protect their environments better and protect identities where ever the are and providing protection across different identity providers.
Praveen718's avatar
Praveen718
Icon for Microsoft rankMicrosoft
Mar 31, 2023

HeyHeikeRitter 
The ITDR module is one of the important components when it comes to M365D, the ITDR helps us to prioritize things, add more context and gives us a timeline of the things. Whenever an incident occurs, the first thing anyone would be checking is:
"What is happening?"
"Who is the user associated?"
"What are the devices associated?"
and able to answer them all via the ITDR portal is so helpful.
Corelating many alerts, automating them and finally combining them to an incident and giving them a risk level score is one of the components I like, and this helps analysts when it comes to Proactive hunting.

 

Also HeikeRitter and team, loved all the episodes, Keep'em coming. Looking forward.
Best,
Praveen A 

Resources