You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: exposure-management/exposure-insights-overview.md
+12-19Lines changed: 12 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -49,17 +49,15 @@ Security Exposure Management provides initiatives that currently include:
49
49
> [!IMPORTANT]
50
50
> Initiatives that are in preview are marked accordingly. Preview initiatives are still in development, and are subject to change.
51
51
52
-
53
52
### Initiative elements
54
53
55
54
**Element** | **Goal** | **Details**
56
55
--- | --- | ---
57
-
**Initiative** | Initiatives help you to gather security projects that have similar resources and workloads, and to assess and remediate the security posture of each project.| Each security initiative provides an all-up score that provides a fast measure of how strong security posture is for the initiative at the current point in time.<br/><br/>The all-up score also provides a target score indicator, the number of critical assets affected, and shows how the score has moved over the last 24 hours.
56
+
**Initiative** | Initiatives help you to gather security projects that have similar resources and workloads, and to assess and remediate the security posture of each project.| Each security initiative provides an all-up score that provides a fast measure of how strong security posture is for the initiative at the current point in time.<br/><br/>The all-up score also provides a target score indicator, the number of critical assets affected, and shows how the score has moved over the last 24 hours.
58
57
**Metric** | Metrics in security initiatives help you to measure exposure risk for different areas within the initiative.| Each metric gathers together one or more recommendations for similar assets.<br/><br/>Metrics can be associated with one or more initiatives.<br/><br/>**Important**: Threat analytics initiatives don't have metrics. They have recommendations only.
59
58
**Recommendations** |Security recommendations help you to understand the compliance state for a specific security initiative. | All security initiatives have recommendations associated with them.<br/><br/>Recommendations can be associated with one or more initiatives.<br/><br/> Within initiatives, recommendations are assigned a compliance state.
60
59
**Events** | Events help you to monitor initiative changes. | Events notify you when there's a drop in an all-up initiative score or metric score, indicating that exposure risk grew.
61
60
62
-
63
61
## Working with initiatives
64
62
65
63
You can prioritize which initiatives you want to see on the **Overview** dashboard. Review the initiative score, and drill down into initiatives to see associated metrics and understand where gaps or risks reside.
@@ -69,15 +67,15 @@ You can prioritize which initiatives you want to see on the **Overview** dashboa
69
67
On the **Metrics** tab of an initiative, or in the **Metrics** section of **Exposure Insights**, you can see the metric state, its effect and relative importance in an initiative, and recommendations to improve the metric. For each metric you can:
70
68
71
69
- Review metrics properties, including:
72
-
-**14-day trend**: Shows the metric value changes over the last 14 days.
73
-
-**Affected items**: The number of items within the metric. In most cases, these items would be assets that are exposed or that create a risk factor. In other cases, affected items would be the number of missing Microsoft secure score points to effectively implement recommended controls.
74
-
-**Total**: Total number of assets under the metric scope.
75
-
-**Weight**: The relative weight (importance) of the metric within the initiative, and its effect on the initiative score. From one (lowest) to ten (highest).
76
-
-**Score impact**: The impact that completing the metric (getting it to 0%) has on the security initiative. Meaning if a given metric is completed, the score impact is the addition seen to the initiative score.
77
-
-**State**: Shows whether the metric needs attention, the risk was mitigated outside Security Exposure Management and shouldn't affect the initiative score, or was mitigated and the initiative score should be adjusted accordingly.
78
-
-**Current value**: Current percentage of exposed assets within the total assets covered by the metric, with the state for each metric. Zero percent is best since there's no exposure, while 100% is worst.
79
-
-**Recommendations**: Security recommendations associated with the metric.
80
-
-**Last Updated** shows the last date the metric was updated.
70
+
-**14-day trend**: Shows the metric value changes over the last 14 days.
71
+
-**Affected items**: The number of items within the metric. In most cases, these items would be assets that are exposed or that create a risk factor. In other cases, affected items would be the number of missing Microsoft secure score points to effectively implement recommended controls.
72
+
-**Total**: Total number of assets under the metric scope.
73
+
-**Weight**: The relative weight (importance) of the metric within the initiative, and its effect on the initiative score. From one (lowest) to ten (highest).
74
+
-**Score impact**: The impact that completing the metric (getting it to 0%) has on the security initiative. Meaning if a given metric is completed, the score impact is the addition seen to the initiative score.
75
+
-**State**: Shows whether the metric needs attention, the risk was mitigated outside Security Exposure Management and shouldn't affect the initiative score, or was mitigated and the initiative score should be adjusted accordingly.
76
+
-**Current value**: Current percentage of exposed assets within the total assets covered by the metric, with the state for each metric. Zero percent is best since there's no exposure, while 100% is worst.
77
+
-**Recommendations**: Security recommendations associated with the metric.
78
+
-**Last Updated** shows the last date the metric was updated.
81
79
82
80
- Filter metrics for specific findings.
83
81
- Drill down into metrics to review and fix associated issues.
@@ -90,7 +88,6 @@ In some cases, metrics display grayed out because the underlying data for the me
90
88
91
89
Grayed out metrics aren't considered for score calculation.
92
90
93
-
94
91
## Working with recommendations
95
92
96
93
Security Exposure Management ingests security recommendations from multiple sources, including Microsoft Defender for Cloud running the [Defender for Cloud Security Posture Management (CSPM) plan](/azure/defender-for-cloud/concept-cloud-security-posture-management), [Microsoft Secure Score](/defender-xdr/microsoft-secure-score), Microsoft threat analytics, and other Microsoft workloads. Security Exposure Management integrates all of these recommendations into a single security catalog.
@@ -122,7 +119,7 @@ Security Exposure Management uses secure score as one of its sources for initiat
122
119
123
120
The exposure state for a security initiative is reflected in the initiative score.
124
121
125
-
-**Initiatives with metrics**: For initiatives with metrics, the score is calculated based on the value and weight of metrics within the initiative.
122
+
-**Initiatives with metrics**: For initiatives with metrics, the score is calculated based on the value and weight of metrics within the initiative.
126
123
-**Initiatives without metrics**: For threat initiatives that don't have metrics, the initiative score is calculated in the same way that [Secure Score is calculated](/defender-xdr/microsoft-secure-score#how-recommended-actions-are-scored).
127
124
128
125
For initiatives with metrics:
@@ -139,7 +136,6 @@ On the **History** tab of an initiative, you can:
139
136
- Filter for specific time points.
140
137
- Drill down to specific changes.
141
138
142
-
143
139
:::image type="content" source="media/exposure-insights-overview/initiatives-history.png" alt-text="Screenshot of the Initiative history tab showing the graph and dates of changes." lightbox="media/exposure-insights-overview/initiatives-history.png":::
144
140
145
141
When you drill down into a specific change, you can see the percentage effects of metrics in the initiative score, along with the change reason. Reasons include:
@@ -149,22 +145,19 @@ When you drill down into a specific change, you can see the percentage effects o
149
145
-**Metric removed** - The metric is no longer relevant for that specific initiative. For instance, if a better suggestion is introduced or it becomes irrelevant.
150
146
-**Metric depreciated** - The metric is removed globally.
151
147
152
-
153
148
Selecting the metric that changed provides more details about the change. For instance, it might display the new weight of a property change, or the number of affected assets before or after the change.
154
149
155
150
:::image type="content" source="media/exposure-insights-overview/initiatives-history-details.png" alt-text="Screenshot of the metric change side panel in the Initiatives history tab." lightbox="media/exposure-insights-overview/initiatives-history-details.png":::
156
151
157
152
You can't control the metric or score changes in advance.
158
153
159
-
160
154
## Reviewing events
161
155
162
-
163
156
Events measure the score drop or worsening in the metric status. Events include:
164
157
165
158
-**Metric score drop events**: These events are issued with there's a decrease of at least 2% in metric score (exposure grew by 2%) since yesterday.
166
159
-**Initiative score drop events**: These events are issued when there's a decrease of at least 2% in initiative score since yesterday.
167
-
-**New Initiave event**: These events are issued when a new inititave is available in MSEM.
160
+
-**New Initiative event**: These events are issued when a new initiative is available in MSEM.
0 commit comments