You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: ATPDocs/security-assessment.md
+14-4Lines changed: 14 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,13 +9,13 @@ ms.topic: how-to
9
9
10
10
Typically, organizations of all sizes have limited visibility into whether or not their on-premises apps and services could introduce a security vulnerability to their organization. The problem of limited visibility is especially true regarding use of unsupported or outdated components.
11
11
12
-
While your company may invest significant time and effort on hardening identities and identity infrastructure (such as Active Directory, Active Directory Connect) as an on-going project, it's easy to remain unaware of common misconfigurations and use of legacy components that represent one of the greatest threat risks to your organization.
12
+
While your company might invest significant time and effort on hardening identities and identity infrastructure (such as Active Directory, Active Directory Connect) as an ongoing project, it's easy to remain unaware of common misconfigurations and use of legacy components that represent one of the greatest threat risks to your organization.
13
13
14
14
Microsoft security research reveals that most identity attacks utilize common misconfigurations in Active Directory and continued use of legacy components (such as NTLMv1 protocol) to compromise identities and successfully breach your organization. To combat this effectively, Microsoft Defender for Identity now offers proactive identity security posture assessments to detect and recommend actions across your on-premises Active Directory configurations.
15
15
16
16
## What do Defender for Identity security assessments provide?
17
17
18
-
Defender for Identity's security posture assessments are available in [Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score), and provide:
18
+
Defender for Identity security posture assessments are available in [Microsoft Secure Score](/microsoft-365/security/defender/microsoft-secure-score), and provide:
19
19
20
20
-**Detections and contextual data** on known exploitable components and misconfigurations, along with relevant paths for remediation.
21
21
@@ -25,11 +25,21 @@ Defender for Identity's security posture assessments are available in [Microsoft
25
25
26
26
Microsoft Secure Score is a measurement of an organization's security posture, with a higher number indicating more recommended actions taken. It can be found at <https://security.microsoft.com/securescore> in the [Microsoft Defender portal](/microsoft-365/security/defender/microsoft-365-defender).
27
27
28
+
### Categorization of Defender for Identity security posture assessments
29
+
30
+
Defender for Identity security posture assessments have five key categories. Each category addresses specific identity security risks and provides remediation guidance.
31
+
32
+
-**Hybrid security**: Identifies misconfigurations in environments that integrate on-premises (e.g., Active Directory) and cloud-based identity providers (e.g., Entra ID, Okta). Assesses risks related to synchronization, authentication, and authorization across platforms.
33
+
-**Identity infrastructure**: Detects misconfigurations and vulnerabilities in core identity components, including domain controllers.
34
+
-**Certificates**: Assesses Active Directory Certificate Services (AD CS) for security gaps, such as misconfigured certificate templates or weak certificate authority settings. Identifying and addressing these issues helps prevent unauthorized access that could arise from certificate-related vulnerabilities.
35
+
-**Group policy**: Analyzes Group Policy configurations to identify settings that might allow privilege escalation or unauthorized lateral movement within the network. Ensuring secure Group Policy settings helps maintain proper access controls and system configurations.
36
+
-**Accounts**: Reviews users, devices, and groups to pinpoint security risks such as weak passwords, inactive accounts, or improper permissions.
37
+
28
38
## Access Defender for Identity security posture assessments
29
39
40
+
> [!NOTE]
30
41
You must have a Defender for Identity license to view Defender for Identity security posture assessments in Microsoft Secure Score.
31
-
32
-
While *certificate template* assessments are available to all customers that have AD CS installed on their environment, *certificate authority* assessments are available only to customers who've installed a sensor on an AD CS server. For more information, see [Configuring sensors for AD FS and AD CS](deploy/active-directory-federation-services.md).
42
+
While *certificate template* assessments are available to all customers with AD CS installed in their environment, *certificate authority* assessments are available only to customers who have installed a sensor on an AD CS server. For more information, see [Configuring sensors for AD FS and AD CS](deploy/active-directory-federation-services.md).
Copy file name to clipboardExpand all lines: ATPDocs/whats-new.md
+1-3Lines changed: 1 addition & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,9 +25,7 @@ For updates about versions and features released six months ago or earlier, see
25
25
## March 2025
26
26
27
27
### New LDAP query events added to the IdentityQueryEvents table in Advanced Hunting
28
-
New LDAP query events will be added by March 6th to the `IdentityQueryEvents` table in Advanced Hunting to provide more visibility into additional LDAP search queries running in the customer environment.
29
-
This update may lead to an increase in activity within the Advanced Hunting IdentityQueryEvents table for LDAP queries. If you have custom detections related to these queries, you may see a higher number of triggered alerts.
30
-
We recommend that you review your existing custom detections to ensure they align with your objectives. If needed, you can adjust your query accordingly.
28
+
New LDAP query events were added to the `IdentityQueryEvents` table in Advanced Hunting to provide more visibility into additional LDAP search queries running in the customer environment.
-[FAQs on Responsible AI](/copilot/security/rai-faqs-security-copilot)
45
47
46
48
## Microsoft Copilot integration in Microsoft Defender
47
49
48
50
[Microsoft Security Copilot](/security-copilot/microsoft-security-copilot) brings together the power of AI and human expertise to help security teams respond to attacks faster and more effectively. Security Copilot is embedded in the Microsoft Defender portal to help provide security teams with enhanced capabilities to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence. Copilot in Defender is available to users who have provisioned access to Security Copilot.
49
51
52
+
Furthermore, Security Copilot operates using [Microsoft's AI principles](https://www.microsoft.com/ai/responsible-ai). To know more, see the [Security Copilot Responsible AI FAQs](/copilot/security/rai-faqs-security-copilot).
53
+
50
54
## Key features
51
55
52
56
### Investigate and respond to incidents like an expert
Copy file name to clipboardExpand all lines: unified-secops-platform/cases-overview.md
+10-6Lines changed: 10 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -49,13 +49,13 @@ Case management is available in the Defender portal, and to use it, you must hav
49
49
50
50
For more information, see [Connect Microsoft Sentinel to the Defender portal](microsoft-sentinel-onboard.md).
51
51
52
-
Use this table to plan your RBAC of case management:
52
+
Use Defender XDR unified RBAC or Microsoft Sentinel roles to grant access to case management features.
53
53
54
-
| Cases feature |Minimum permissions required in Microsoft Defender XDR Unified RBAC |
55
-
|---|---|
56
-
| View only</br>- case queue</br>- case details</br>- tasks</br>- comments</br>- case audits | Security operations > Security data basics (read)|
57
-
| Create and Manage</br>- cases and case tasks</br>- assign</br>- update status</br>- link and unlink incidents | Security operations > Alerts (manage)|
58
-
| Customize case status options | Authorization and setting > Core Security settings (manage)|
54
+
| Cases feature | Microsoft Defender XDR Unified RBAC| Microsoft Sentinel role|
55
+
|---|---|---|
56
+
| View only</br>- case queue</br>- case details</br>- tasks</br>- comments</br>- case audits | Security operations > Security data basics (read)| Microsoft Sentinel Reader |
57
+
| Create and Manage</br>- cases and case tasks</br>- assign</br>- update status</br>- link and unlink incidents | Security operations > Alerts (manage)</br>**or**</br>Security operations > Response (manage) | Microsoft Sentinel Responder |
58
+
| Customize case status options | Authorization and setting > Core Security settings (manage)| Microsoft Sentinel Contributor |
59
59
60
60
For more information, see [Microsoft Defender XDR Unified role-based access control (RBAC)](/defender-xdr/manage-rbac).
61
61
@@ -65,6 +65,8 @@ To start using case management, select **Cases** in the Defender portal to acces
65
65
66
66
:::image type="content" source="media/cases-overview/cases-queue-view.png" alt-text="Screenshot of case queue.":::
67
67
68
+
The maximum allowed per tenant is 100,000 cases.
69
+
68
70
## Case details
69
71
70
72
Each case has a page which allows analysts to manage the case and displays important details.
@@ -112,6 +114,8 @@ Alternatively, if the IR team needs to escalate one or more incidents to the hun
112
114
113
115
:::image type="content" source="media/cases-overview/link-incident-from-incident-graph.png" alt-text="Screenshot showing the link incident option from ellipses menu in the incident view.":::
114
116
117
+
Each case has a threshold of 100 linked incidents.
118
+
115
119
### Activity log
116
120
117
121
Need to write down notes, or that key detection logic to pass along? Create plain text comments and review the audit events in the activity log. Comments are a great place to quickly add information to a case.
0 commit comments