Microsoft Security Operations AnalystMitigate threats using Microsoft Defender XDRHard
A security operations team is investigating a sophisticated attack that involved an attacker compromising an on-premises Active Directory account, moving laterally to several servers, and then attempting to exfiltrate data from a cloud storage account. The team needs to correlate alerts from identity, endpoint, and cloud app security solutions to understand the full scope of the attack. Which feature of Microsoft Defender XDR is specifically designed for this type of cross-domain correlation and unified investigation?
- AAdvanced Hunting
- BAutomated investigation and remediation
- CSecurity recommendations
- DMicrosoft Defender Portal
Show answer & explanationAnswer & explanation
Correct answer: A. Advanced Hunting
Advanced Hunting in Microsoft Defender XDR allows security analysts to proactively search for threats across various data sources (endpoints, identities, email & collaboration, cloud apps) using Kusto Query Language (KQL), enabling cross-domain correlation for complex attack investigations.
Why the other options are wrong
- B. Automated investigation and remediation focuses on automated responses to specific alerts, not proactive cross-domain threat hunting and correlation.
- C. Security recommendations focus on improving security posture, not investigating active, multi-stage attacks.
- D. The Microsoft Defender Portal is the unified interface, but 'Advanced Hunting' is the specific feature within it that enables the described cross-domain querying and correlation.
Advanced Hunting
A powerful, flexible, and interactive query-based threat-hunting tool in Microsoft Defender XDR that allows security teams to proactively inspect data from various Defender products (Endpoint, Identity, Office 365, Cloud Apps).
- Uses Kusto Query Language (KQL).
- Enables cross-domain correlation and custom detection rules.
- Provides access to raw event data for deep investigation.
Memory trick: To hunt across domains, you need advanced tools and a sharp eye.