Microsoft Certified: Azure Security Engineer AssociateManage security operationsMedium
A company has implemented Microsoft Defender for Cloud for server protection. They receive an alert labeled 'High severity - Anomalous SSH activity detected on VM-Prod-01'. The security team needs to quickly understand the scope of the attack, including other potentially affected resources and the attacker's tactics, techniques, and procedures (TTPs). Where in Microsoft Defender for Cloud should they look first for this consolidated information?
- AThe 'Workload protections' blade, under 'Server protection'.
- BThe 'Regulatory compliance' dashboard.
- CThe 'Security alerts' blade, filtering for VM-Prod-01.
- DThe specific alert's 'Incident' details page.
Show answer & explanationAnswer & explanation
Correct answer: D. The specific alert's 'Incident' details page.
In Microsoft Defender for Cloud, related alerts are grouped into security incidents. The incident details page provides a consolidated view of all related alerts, affected resources, and often includes MITRE ATT&CK TTPs, making it the ideal starting point for understanding the scope of an attack.
Why the other options are wrong
- A. The 'Workload protections' blade shows protection status and recommendations, not specific incident investigation details.
- B. The 'Regulatory compliance' dashboard monitors compliance against standards, not active security incidents.
- C. Filtering the 'Security alerts' blade would show individual alerts, but not the consolidated incident view with related entities and TTPs.
Defender for Cloud Security Incidents
A feature in Microsoft Defender for Cloud (and Sentinel) that groups related security alerts into a single, comprehensive view to facilitate investigation and response.
- Correlates alerts across different resources and services.
- Provides a timeline of events and affected entities.
- Often includes MITRE ATT&CK TTPs for context.
Memory trick: Incidents Provide the Full Attack Story.