You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When an automatic attack disruption triggers in Microsoft Defender XDR, the details about the risk and the containment status of compromised assets are available during and after the process. You can view the details on the incident page, which provides the full details of the attack and the up-to-date status of associated assets.
32
31
33
32
## Review the incident graph
@@ -58,16 +57,18 @@ You can use specific queries in [advanced hunting](advanced-hunting-overview.md)
58
57
Contain actions triggered by attack disruption are found in the [DeviceEvents table](advanced-hunting-deviceevents-table.md) in advanced hunting. Use the following queries to hunt for these specific contain actions:
Microsoft Defender XDR correlates millions of individual signals to identify active ransomware campaigns or other sophisticated attacks in the environment with high confidence. While an attack is in progress, Defender XDR disrupts the attack by automatically containing compromised assets that the attacker is using through automatic attack disruption.
33
31
34
32
Automatic attack disruption limits lateral movement early on and reduces the overall impact of an attack, from associated costs to loss of productivity. At the same time, it leaves security operations teams in complete control of investigating, remediating, and bringing assets back online.
@@ -105,7 +103,7 @@ The Defender XDR user experience now includes additional visual cues to ensure v
105
103
106
104
- A tag titled *Attack Disruption* appears next to affected incidents
107
105
108
-
1. On the incident page:
106
+
2. On the incident page:
109
107
110
108
- A tag titled *Attack Disruption*
111
109
- A yellow banner at the top of the page that highlights the automatic action taken
@@ -121,7 +119,7 @@ For more information, see [view attack disruption details and results](autoad-re
121
119
122
120
## Next steps
123
121
124
-
-[Configuring automatic attack disruption in Microsoft Defender XDR](configure-attack-disruption.md)
Copy file name to clipboardExpand all lines: defender-xdr/configure-deception.md
+5-6Lines changed: 5 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Configure the deception capability in Microsoft Defender XDR
3
-
description: Learn how to create, edit, and delete deception rules in Microsoft Defender XDR.
3
+
description: Learn how to create, edit, and delete deception rules in the Microsoft Defender portal.
4
4
ms.service: defender-xdr
5
5
f1.keywords:
6
6
- NOCSH
@@ -12,21 +12,20 @@ audience: ITPro
12
12
ms.collection:
13
13
- m365-security
14
14
- tier1
15
-
ms.topic: conceptual
15
+
ms.topic: how-to
16
16
search.appverid:
17
17
- MOE150
18
18
- MET150
19
19
ms.date: 01/12/2024
20
+
appliesto:
21
+
- Microsoft Defender XDR
22
+
#customer intent: As a security analyst, I want to learn how to configure the deception capability so that I can protect my organization from high-impact attacks that use human-operated lateral movement.
20
23
---
21
24
22
25
# Configure the deception capability in Microsoft Defender XDR
> The built-in [deception](deception-overview.md) capability in Microsoft Defender XDR covers all Windows clients onboarded to Microsoft Defender for Endpoint. Learn how to onboard clients to Defender for Endpoint in [Onboard to Microsoft Defender for Endpoint](/defender-endpoint/onboarding).
Copy file name to clipboardExpand all lines: defender-xdr/deception-overview.md
+10-11Lines changed: 10 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,27 +7,26 @@ f1.keywords:
7
7
ms.author: diannegali
8
8
author: diannegali
9
9
ms.localizationpriority: medium
10
-
manager: dansimp
10
+
manager: deniseb
11
11
audience: ITPro
12
12
ms.collection:
13
13
- m365-security
14
14
- tier1
15
-
ms.topic: conceptual
15
+
ms.topic: concept-article
16
16
search.appverid:
17
17
- MOE150
18
18
- MET150
19
19
ms.date: 08/14/2024
20
+
appliesto:
21
+
- Microsoft Defender XDR
22
+
- Microsoft Defender for Endpoint
23
+
#customer intent: As a security analyst, I want to understand how to manage the deception capability in Microsoft Defender XDR to detect human-operated attacks with lateral movement.
20
24
---
21
25
22
26
# Manage the deception capability in Microsoft Defender XDR
> Some information in this article relates to prereleased products/services that might be substantially modified before commercially release. Microsoft makes no warranties, express or implied, with respect to the information provided here.
33
32
@@ -63,9 +62,9 @@ Attackers interacting with the fake network assets set up by the deception capab
63
62
64
63
The built-in deception capability in the Microsoft Defender portal uses rules to make decoys and lures that match your environment. The feature applies machine learning to suggest decoys and lures that are tailored to your network. You can also use the deception feature to manually create the decoys and lures. These decoys and lures are then automatically deployed to your network and planted to devices you specify using PowerShell.
65
64
66
-
:::image type="content" source="/defender/media/deception/fig1-deception.png" alt-text="Screenshot of an attack with lateral movement and where deception intercepts the attack" lightbox="/defender/media/deception/fig1-deception.png":::
65
+
Deception technology, through high confidence detections of human-operated lateral movement, alerts security teams when an attacker interacts with fake hosts or lures. Here's the process of how the deception capability works:
67
66
68
-
*Figure 1. Deception technology, through high confidence detections of human-operated lateral movement, alerts security teams when an attacker interacts with fake hosts or lures*
67
+
:::image type="content" source="/defender/media/deception/fig1-deception.png" alt-text="Screenshot of an attack with lateral movement and where deception intercepts the attack" lightbox="/defender/media/deception/fig1-deception.png":::
69
68
70
69
**Decoys** are fake devices and accounts that appear to belong to your network. **Lures** are fake content planted on specific devices or accounts and are used to attract an attacker. The content can be a document, a configuration file, cached credentials, or any content that an attacker can likely read, steal, or interact with. Lures imitate important company information, settings, or credentials.
71
70
@@ -94,9 +93,9 @@ The alert details contain:
94
93
- The decoy device or user account where the alert originated
95
94
- The type of attack like sign in attempts or lateral movement attempts
96
95
97
-
:::image type="content" source="/defender/media/deception/deception-alert-small.png" alt-text="Screenshot of a deception alert highlighting the tag and the attempt" lightbox="/defender/media/deception/deception-alert.png":::
96
+
Here's an example of a deception-related alert:
98
97
99
-
*Figure 2. Details of a deception-related alert*
98
+
:::image type="content" source="/defender/media/deception/deception-alert-small.png" alt-text="Screenshot of a deception alert highlighting the tag and the attempt" lightbox="/defender/media/deception/deception-alert.png":::
False positives or negatives can occasionally occur with any threat protection solution. If [automated investigation and response capabilities](m365d-autoir.md) in Microsoft Defender XDR missed or wrongly detected something, there are steps your security operations team can take:
32
31
33
32
-[Report a false positive/negative to Microsoft](#report-a-false-positivenegative-to-microsoft-for-analysis)
With Microsoft Defender XDR, when an [automated investigation](m365d-autoir.md) runs, details about that investigation are available both during and after the automated investigation process. If you have the [necessary permissions](m365d-action-center.md#required-permissions-for-action-center-tasks), you can view those details in an investigation details view that provides you with up-to-date status and the ability to approve any pending actions.
If your organization is using [Microsoft Defender XDR](microsoft-365-defender.md), your security operations team receives an alert within the Microsoft Defender portal whenever a malicious or suspicious activity or artifact is detected. Given the seemingly never-ending flow of threats that can come in, security teams often face the challenge of addressing the high volume of alerts. Fortunately, Microsoft Defender XDR includes automated investigation and response (AIR) capabilities that can help your security operations team address threats more efficiently and effectively.
30
30
31
31
This article provides an overview of AIR and includes links to next steps and additional resources.
@@ -97,7 +97,6 @@ The new Automated investigation & response card is available in the Microsoft De
97
97
98
98
Using the Automated investigation & response card, your security operations team can quickly navigate to the Action center by selecting the **Approve in Action Center** link, and then taking appropriate actions. The card enables your security operations team to more effectively manage actions that are pending approval.
99
99
100
-
101
100
## Next steps
102
101
103
102
-[See the prerequisites for automated investigation and response](m365d-configure-auto-investigation-response.md#prerequisites-for-automated-investigation-and-response-in-microsoft-365-defender)
During and after an automated investigation in Microsoft Defender XDR, remediation actions are identified for malicious or suspicious items. Some kinds of remediation actions are taken on devices, also referred to as endpoints. Other remediation actions are taken on identities, accounts, and email content. In addition, some types of remediation actions can occur automatically, whereas other types of remediation actions are taken manually by your organization's security team. When an automated investigation results in one or more remediation actions, the investigation completes only when the remediation actions are taken, approved, or rejected.
0 commit comments