Skip to content

Commit 3ec55ce

Browse files
riswintoriswinto
committed
new module in irm alerts
1 parent a8de3a6 commit 3ec55ce

14 files changed

+308
-0
lines changed

‎learn-pr/wwl-sci/purview-insider-risk-investigate-alerts/includes/insider-risk-cases.md

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
Cases in Microsoft Purview Insider Risk Management allow investigators to track user risk over time, review associated alerts, and take action based on the severity and context of the activity. Each case focuses on a single user and can include one or more alerts. Cases are created manually when an alert requires deeper review or coordination with other teams.
2+
3+
Use the **Cases** dashboard to view all active and closed cases, assign ownership, and manage follow-up actions such as escalation, communication, and resolution.
4+
5+
## Respond to alerts
6+
7+
Not all alerts require a case. You can take action directly from the **Alerts** queue by confirming or dismissing alerts as part of your triage process:
8+
9+
- **Dismiss** an alert if it's a false positive or doesn't require further review.
10+
- **Confirm** an alert to indicate a policy violation and optionally create a case for deeper investigation.
11+
12+
Creating a case is recommended when an alert involves serious risk, multiple incidents, or needs collaboration across teams. Once a case is created, you can take further action such as sending notices, escalating, or resolving with a classification.
13+
14+
## Create and manage cases
15+
16+
Cases are created from alerts when an incident needs further review or response. Once created, cases can be updated with new alerts and managed through their lifecycle. You can:
17+
18+
- Assign or reassign ownership
19+
- Send an email notice to the user
20+
- Escalate to Microsoft Purview eDiscovery (Premium)
21+
- Run Power Automate flows
22+
- Create or view a connected Microsoft Teams team
23+
- Resolve the case with a classification of Benign or Confirmed policy violation
24+
25+
You can assign a case to any user with one of these roles: **Insider Risk Management**, **Analyst**, or **Investigator**.
26+
27+
:::image type="content" source="../media/insider-risk-case-details.png" alt-text="Screenshot showing how to create a case in Insider Risk Management." lightbox="../media/insider-risk-case-details.png":::
28+
29+
## Use the Cases dashboard
30+
31+
The Cases dashboard lists each case and includes key details:
32+
33+
- Case name and ID
34+
- Assigned user (anonymized if enabled)
35+
- Status: **Active** or **Closed**
36+
- Number of alerts
37+
- Time opened and last updated
38+
- Last updated by
39+
40+
You can search by case ID or keywords, and use filters to narrow by status, date opened, or last updated.
41+
42+
To customize the view, select **Customize columns**. To save filters for future use, apply filters and select **Save this view**.
43+
44+
:::image type="content" source="../media/insider-risk-case-details.png" alt-text="Screenshot showing the Cases dashboard in Insider Risk Management." lightbox="../media/insider-risk-case-details.png":::
45+
46+
## Investigate a case
47+
48+
Selecting a case opens a detailed investigation view with multiple tabs:
49+
50+
- **Case overview**: User identity, department, risk score, associated alerts
51+
- **Alerts**: Status, severity, and alert ID for each included alert
52+
- **User activity**: Timeline of scored risk activity from the alert or broader user history
53+
- **Activity explorer (preview)**: Detailed timeline and metadata for each associated event
54+
55+
**User activity** shows the overall timeline of user risk behavior, while A**ctivity explorer** focuses on event-level details within the case scope.
56+
57+
- **Forensic evidence**: Screen captures from activity that triggered the alert
58+
- **Content explorer**: Copies of files and email messages associated with risk alerts
59+
- **Case notes:** Permanent, timestamped notes added by analysts
60+
- **Contributors**: Users added to the case for collaboration
61+
62+
:::image type="content" source="../media/insider-risk-case-details.png" alt-text="Screenshot showing details of a case investigation." lightbox="../media/insider-risk-case-details.png":::
63+
64+
> [!NOTE]
65+
> Contributors can view the case and add notes, but they can't edit contributor lists or confirm/dismiss alerts.
66+
67+
## Take action on a case
68+
69+
The case toolbar includes actions for responding to the alert:
70+
71+
### Send email notice
72+
73+
Send a message to the user to reinforce policies or training. Notices are based on templates and are recorded in the **Case notes** tab.
74+
75+
> [!TIP]
76+
> Sending a notice doesn't close the case. To resolve it, you must select **Resolve case** separately.
77+
78+
### Escalate for investigation
79+
80+
Use this option to escalate the case to a Microsoft Purview eDiscovery (Premium) case for deeper investigation and legal hold workflows.
81+
82+
### Run Power Automate flows
83+
84+
Trigger flows for common tasks such as:
85+
86+
- Notifying a manager
87+
- Creating a record in ServiceNow
88+
- Requesting details from HR
89+
90+
### Create or view Teams team
91+
92+
If Teams integration is enabled in Insider Risk Management settings, a team is created automatically when a case is opened. Teams are archived when a case is resolved. To enable Teams integration:
93+
94+
1. Go to the [Microsoft Purview portal](https://purview.microsoft.com/).
95+
1. Select **Settings** > **Insider Risk Management** > **Microsoft Teams**.
96+
1. Select the toggle to enable integration with Microsoft Teams.
97+
98+
:::image type="content" source="../media/insider-risk-teams-integration.png" alt-text="Screenshot showing where to enable Teams integration in Microsoft Purview Insider Risk Management." lightbox=" ../media/insider-risk-teams-integration.png":::
99+
100+
## Resolve a case
101+
102+
When investigation is complete, resolve the case as:
103+
104+
- **Benign**: Behavior is low-risk, accidental, or false positive
105+
- **Confirmed policy violation**: Behavior is intentional or a serious violation
106+
107+
Enter a reason for the resolution. Resolution actions are recorded in Case notes, and the case status is updated to Closed.

‎learn-pr/wwl-sci/purview-insider-risk-investigate-alerts/includes/investigate-alerts-defender.md

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
**Microsoft Defender Extended Detection and Response (XDR)** helps expand investigation capabilities for insider risk by integrating alerts from Microsoft Purview Insider Risk Management with other Microsoft security data. This combined view gives security operations center (SOC) analysts the context they need to assess user behavior, correlate risk signals, and take action across Microsoft 365 workloads.
2+
3+
Use this view to correlate insider risk alerts with data from other services like Microsoft Defender for Endpoint, Microsoft Entra ID, and Microsoft Purview Data Loss Prevention.
4+
5+
## Access insider risk alerts in Defender XDR
6+
7+
To review alerts in the [Microsoft Defender portal](https://security.microsoft.com/):
8+
9+
1. Go to **Investigation & response** > **Incidents & alerts** > **Incidents**.
10+
1. Use the **Service source** filter to select **Microsoft Purview Insider Risk Management**
11+
12+
:::image type="content" source="../media/defender-insider-risk-incidents.png" alt-text="Screenshot showing the Incidents page being filtered to show Microsoft Purview Insider Risk Management incidents." lightbox="../media/defender-insider-risk-incidents.png":::
13+
14+
This filter shows alerts from Insider Risk Management and highlights when those alerts are grouped into incidents with alerts from other Microsoft tools.
15+
16+
## Understand the investigation view
17+
18+
When insider risk alerts appear in the Defender portal, they might be:
19+
20+
- Part of a unified **incident** that includes multiple alert types
21+
- Listed individually in the **alert queue** for review
22+
- Linked to other activity such as endpoint behavior or identity signals
23+
24+
Selecting an alert or incident provides details such as severity, classification, and alert mappings. You can also view the user entity page for a risk summary and associated activity.
25+
26+
## Review alert status and classification sync
27+
28+
Alert status and classification automatically sync between Microsoft Purview and Microsoft Defender:
29+
30+
| Microsoft Defender status | Insider Risk Management status |
31+
|-----|-----|
32+
| New, In progress | Needs review |
33+
| Resolved | Dismissed or Confirmed (based on classification) |
34+
35+
How classification types align:
36+
37+
| Microsoft Defender classification | Insider Risk Management classification |
38+
|-----|-----|
39+
| True positive | Confirmed |
40+
| Information, expected activity | Dismissed |
41+
| False positive | Dismissed |
42+
43+
Updates to status, classification, and alert details reflect across both portals within about 30 minutes.
44+
45+
## Investigate insider risk activity with advanced hunting
46+
47+
Defender's **Advanced hunting** feature allows deeper investigation of insider risk activity using Kusto Query Language (KQL). Insider risk alerts and behavior logs are available in the following tables:
48+
49+
- `AlertInfo`: Alert metadata from multiple sources
50+
- `AlertEvidence`: Linked entities such as files or users
51+
- `DataSecurityBehaviors`: Policy-triggering behavioral patterns
52+
- `DataSecurityEvents`: Detailed events from policy violations
53+
54+
These tables support cross-tool investigation. For example, you might query:
55+
56+
```kusto
57+
DataSecurityEvents
58+
| where FileName endswith ".zip"
59+
| where ActionType == "FileUploaded"
60+
```
61+
62+
You must be assigned the **Insider Risk Management Analyst** or **Investigator** role in Microsoft Purview to access this data.
63+
64+
## Requirements and setup
65+
66+
Before alerts appear in the Microsoft Defender portal:
67+
68+
The setting **Share user risk details with other security solutions** must be enabled in the Microsoft Purview portal. To enable this setting:
69+
70+
1. Go to the [Microsoft Purview portal](https://purview.microsoft.com/).
71+
1. Select **Settings** > **Insider Risk Management** > **Data sharing**.
72+
1. Enable **Share user risk details with other security solutions**.
73+
74+
:::image type="content" source="../media/enable-data-sharing-insider-risk-settings.png" alt-text="Screenshot showing where to enable data sharing in Microsoft Purview Insider Risk Management." lightbox=" ../media/enable-data-sharing-insider-risk-settings.png":::
75+
76+
Users must have roles in both Microsoft Purview and Microsoft Defender:
77+
78+
- **Defender**: _Security Operator_ or _Security Reader_
79+
- **Purview**: _Insider Risk Management_, _Analyst_, or _Investigator_
80+
81+
Licensing for both solutions is also required. See Microsoft documentation for details.
82+
83+
## Limitations
84+
85+
Not all insider risk data is available in Defender:
86+
87+
- Alerts created from custom detections
88+
- Risky AI usage events
89+
- Non-Microsoft app events
90+
- Exfiltration via email
91+
- Events that occurred before an alert was generated
92+
- Excluded events based on policy settings
93+
94+
Viewing insider risk alerts in Microsoft Defender XDR helps bring together security signals across Microsoft 365. This integration supports broader investigations, faster triage, and more comprehensive incident response.

‎learn-pr/wwl-sci/purview-insider-risk-investigate-alerts/includes/summary.md

Whitespace-only changes.

‎learn-pr/wwl-sci/purview-insider-risk-investigate-alerts/index.yml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
### YamlMime:Module
2+
uid: learn.wwl.purview-insider-risk-investigate-alerts
3+
metadata:
4+
title: Prepare for Microsoft Purview Insider Risk Management
5+
description: "Prepare for Microsoft Purview Insider Risk Management."
6+
ms.date: 1/3/2025
7+
author: wwlpublish
8+
ms.author: riswinto
9+
ms.topic: module
10+
ms.service: purview
11+
hidden: false
12+
title: Prepare for Microsoft Purview Insider Risk Management
13+
summary: Discover strategies for planning and configuring Microsoft Purview Insider Risk Management to meet organizational needs and protect privacy.
14+
abstract: |
15+
After completing this module, you'll be able to:
16+
- Collaborate with stakeholders to prepare for insider risk management.
17+
- Understand what's needed to meet prerequisites for implementation.
18+
- Configure settings to align with compliance and privacy needs.
19+
- Explore how connecting tools and data sources enhances risk management.
20+
prerequisites: |
21+
- Understanding of insider risk concepts.
22+
- Familiarity with organizational compliance and privacy practices.
23+
iconUrl: /training/achievements/generic-badge.svg
24+
levels:
25+
- intermediate
26+
roles:
27+
- auditor
28+
- administrator
29+
- risk-practitioner
30+
products:
31+
- microsoft-purview
32+
- m365
33+
subjects:
34+
- information-protection-governance
35+
- security
36+
units:
37+
- learn.wwl.purview-insider-risk-investigate-alerts.introduction
38+
- learn.wwl.purview-insider-risk-investigate-alerts.plan-insider-risk-management
39+
- learn.wwl.purview-insider-risk-investigate-alerts.insider-risk-management-prerequisites
40+
- learn.wwl.purview-insider-risk-investigate-alerts.configure-insider-risk-settings
41+
- learn.wwl.purview-insider-risk-investigate-alerts.insider-risk-management-integrations
42+
- learn.wwl.purview-insider-risk-investigate-alerts.knowledge-check
43+
- learn.wwl.purview-insider-risk-investigate-alerts.summary
44+
45+
46+
badge:
47+
uid: learn.wwl.purview-insider-risk-investigate-alerts.badge

‎learn-pr/wwl-sci/purview-insider-risk-investigate-alerts/insider-risk-cases.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
### YamlMime:ModuleUnit
2+
uid: learn.wwl.purview-insider-risk-investigate-alerts.investigate-alerts-defender
3+
title: Manage and take action on insider risk cases
4+
metadata:
5+
title: Manage and take action on insider risk cases
6+
description: "Manage and take action on insider risk cases."
7+
ms.date: 04/15/2025
8+
author: wwlpublish
9+
ms.author: riswinto
10+
ms.topic: unit
11+
azureSandbox: false
12+
labModal: false
13+
durationInMinutes: 6
14+
content: |
15+
[!include[](includes/insider-risk-cases.md)]

‎learn-pr/wwl-sci/purview-insider-risk-investigate-alerts/introduction.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
### YamlMime:ModuleUnit
2+
uid: learn.wwl.purview-insider-risk-investigate-alerts.introduction
3+
title: Introduction
4+
metadata:
5+
title: Introduction
6+
description: "Introduction."
7+
ms.date: 04/15/2025
8+
author: wwlpublish
9+
ms.author: riswinto
10+
ms.topic: unit
11+
azureSandbox: false
12+
labModal: false
13+
durationInMinutes: 1
14+
content: |
15+
[!include[](includes/introduction.md)]

‎learn-pr/wwl-sci/purview-insider-risk-investigate-alerts/investigate-alerts-defender.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
### YamlMime:ModuleUnit
2+
uid: learn.wwl.purview-insider-risk-investigate-alerts.investigate-alerts-defender
3+
title: Investigate insider risk alerts in Microsoft Defender XDR
4+
metadata:
5+
title: Investigate insider risk alerts in Microsoft Defender XDR
6+
description: "Investigate insider risk alerts in Microsoft Defender XDR."
7+
ms.date: 04/15/2025
8+
author: wwlpublish
9+
ms.author: riswinto
10+
ms.topic: unit
11+
azureSandbox: false
12+
labModal: false
13+
durationInMinutes: 6
14+
content: |
15+
[!include[](includes/investigate-alerts-defender.md)]

‎learn-pr/wwl-sci/purview-insider-risk-investigate-alerts/media/defender-insider-risk-incidents.png

121 KB
Loading

‎learn-pr/wwl-sci/purview-insider-risk-investigate-alerts/media/enable-data-sharing-insider-risk-settings.png

110 KB
Loading

‎learn-pr/wwl-sci/purview-insider-risk-investigate-alerts/media/insider-risk-case-details.png

135 KB
Loading

0 commit comments

Comments
 (0)