You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/integrations/microsoft-azure/azure-security-microsoft-defender-for-identity.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,8 +10,8 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
10
10
11
11
The Azure Security – Microsoft Defender for Identity app enhances endpoint protection by centralising alert data from various devices, enabling faster detection, investigation, and response to cyber threats. It uses advanced analytics and threat intelligence to identify malicious behaviour and high-risk activity. With detailed dashboards and visualisations, it helps security teams track recurring incidents, assess vulnerabilities, and reduce response time, offering a comprehensive view of your organisation’s endpoint security posture.
12
12
13
-
::note
14
-
This app includes [built-in monitors](#azure-security---microsoft-defender-for-identity-alerts). For details on creating custom monitors, refer to [Create monitors for Azure Security - Microsoft Defender for Identity app](#create-monitors-for-azure-security---microsoft-defender-for-identity-app)
13
+
:::info
14
+
This app includes [built-in monitors](#azure-security---microsoft-defender-for-identity-alerts). For details on creating custom monitors, refer to [Create monitors for Azure Security - Microsoft Defender for Identity app](#create-monitors-for-azure-security---microsoft-defender-for-identity-app).
15
15
:::
16
16
17
17
## Log types
@@ -209,7 +209,7 @@ The **Azure Security - Microsoft Defender for Identity - Overview** dashboard pr
209
209
Security teams can easily identify dominant alert categories, monitor the most recent alerts for immediate action, and track analyst assignments to ensure accountability. The dashboard also highlights top users associated with alerts, helping detect insider threats or compromised accounts that may require deeper investigation.
210
210
211
211
Geo-location mapping adds another layer of insight by showing the origin of alerts, supporting region-specific risk assessments. By combining historical trends with real-time visibility, the dashboard enables security teams to focus on high-impact threats and improve response times.
212
-
<br/><imgsrc=''alt="Azure Security - Microsoft Defender for Identity - Overview" />
212
+
<br/><imgsrc='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Azure-Security-Microsoft-Defender-for-Identity/Azure-Security-Microsoft-Defender-for-Identity-Overview.png'alt="Azure Security - Microsoft Defender for Identity - Overview" />
Additionally, it ranks the most frequently attacked devices and highlights countries linked to malicious or suspicious IP activity, offering clear insight into the most vulnerable assets and regions. This intelligence allows for more focused defences and faster, more effective threat mitigation.
221
221
222
222
By integrating trend analysis, threat origin mapping, and user risk profiling, the Security dashboard empowers analysts to detect emerging patterns, respond proactively, and strengthen the organisation’s resilience against sophisticated endpoint threats.
223
-
<br/><imgsrc=''alt="Azure Security - Microsoft Defender for Identity - Security" />
223
+
<br/><imgsrc='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Azure-Security-Microsoft-Defender-for-Identity/Azure-Security-Microsoft-Defender-for-Identity-Security.png'alt="Azure Security - Microsoft Defender for Identity - Security" />
224
224
225
225
## Create monitors for Azure Security - Microsoft Defender for Identity app
226
226
@@ -236,13 +236,13 @@ import CreateMonitors from '../../reuse/apps/create-monitors.md';
236
236
|`High Severity Alerts`| This alert is triggered when a high-severity threat is detected, allowing you to promptly monitor and respond to potentially harmful events that may compromise endpoint security. It ensures critical incidents are prioritised for swift investigation and mitigation. | Critical | Count > 0|
237
237
|`Embargoed Device`| This alert is triggered when a single device generates multiple alerts, indicating potentially malicious behaviour. It helps you identify high-risk devices, monitor suspicious activity more effectively, and take swift action to prevent further compromise. | Critical | Count > 5 |
238
238
239
-
## Upgrade/Downgrade the Azure Security - Microsoft Defender for Office 365 app (Optional)
239
+
## Upgrade/Downgrade the Azure Security - Microsoft Defender for Identity app (Optional)
240
240
241
241
import AppUpdate from '../../reuse/apps/app-update.md';
242
242
243
243
<AppUpdate/>
244
244
245
-
## Uninstalling the Azure Security - Microsoft Defender for Office 365 app (Optional)
245
+
## Uninstalling the Azure Security - Microsoft Defender for Identity app (Optional)
246
246
247
247
import AppUninstall from '../../reuse/apps/app-uninstall.md';
0 commit comments