Microsoft Defender for Cloud

microsoft-defender-for-cloud

Classification:

attack

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when Microsoft Defender for Cloud raises an alert.

Strategy

Defender for Cloud collects, analyzes, and integrates log data from your Azure, hybrid, and multicloud resources, the network, and connected partner solutions, such as firewalls and endpoint agents. Defender for Cloud uses the log data to detect real threats and reduce false positives. A list of prioritized security alerts is shown in Defender for Cloud, along with the information you need to quickly investigate the problem and take steps to remediate an attack.

Microsoft provides an alert reference guide for understanding each type of alert generated.

Triage and response

  1. Investigate the Microsoft Defender for Cloud alert to determine if it is malicious or benign.
  2. If the finding is deemed malicious, follow the remediation guidance provided by Microsoft and also any internal incident response processes.
  3. A suppression rule can be created to manage noisy or false positive alerts.