Merge pull request #3801 from anunesms/patch-5

Update alerts-overview.md

Author: prmerger-automator[bot]

ATPDocs/alerts-overview.md

@@ -63,7 +63,7 @@ The following table lists the mapping between alert names, their corresponding u
 | [Suspected   WannaCry ransomware attack](lateral-movement-alerts.md#suspected-wannacry-ransomware-attack-external-id-2035)                      | 2035                | Medium                                                   | Lateral movement                                             |
 | [Remote code execution over DNS](lateral-movement-alerts.md#remote-code-execution-attempt-over-dns-external-id-2036)                               | 2036                | Medium                                                   | Lateral movement, Privilege escalation                       |
 | [Suspected   NTLM relay attack](lateral-movement-alerts.md#suspected-ntlm-relay-attack-exchange-account-external-id-2037)                                | 2037                | Medium or Low if observed  using signed NTLM v2 protocol | Lateral  movement, Privilege escalation                      |
-| [Security   principal reconnaissance (LDAP)](credential-access-alerts.md#security-principal-reconnaissance-ldap-external-id-2038)                   | 2038                | Medium                                                   | Credential access                                            |
+| [Security   principal reconnaissance (LDAP)](credential-access-alerts.md#security-principal-reconnaissance-ldap-external-id-2038)                   | 2038                | High (in case resolutions issues or Specific Tool detected) and Medium                                                   | Credential access                                            |
 | [Suspected   NTLM authentication tampering](lateral-movement-alerts.md#suspected-ntlm-authentication-tampering-external-id-2039)                    | 2039                | Medium                                                   | Lateral  movement, Privilege escalation                      |
 | [Suspected   Golden Ticket usage (ticket anomaly using RBCD)](persistence-privilege-escalation-alerts.md#suspected-golden-ticket-usage-ticket-anomaly-using-rbcd-external-id-2040)  | 2040                | High                                                     | Persistence                                                  |
 | [Suspected   rogue Kerberos certificate usage](lateral-movement-alerts.md#suspected-rogue-kerberos-certificate-usage-external-id-2047)                 | 2047                | High                                                     | Lateral movement                                             |