Security alerts in Microsoft Defender for Identity

What are Microsoft Defender for Identity security alerts?

Microsoft Defender for Identity security alerts provide information about the suspicious activities detected by Defender for Identity, and the actors and computers involved in each threat. Alert evidence lists contain direct links to the involved users and computers, to help make your investigations easy and direct.

The Identity alerts page gives you cross-domain signal enrichment and automated identity response capabilities. The benefit of investigating alerts with Microsoft Defender XDR is that Microsoft Defender for Identity alerts are correlated with information obtained from each of the other products in the suite. These enhanced alerts are consistent with the other Microsoft Defender XDR alert formats originating from Microsoft Defender for Office 365 and Microsoft Defender for Endpoint.

Alerts originating from Defender for Identity trigger Microsoft Defender XDR automated investigation and response (AIR) capabilities, including automatically remediating alerts and the mitigation of tools and processes that can contribute to the suspicious activity.

Microsoft Defender for Identity alerts currently appear in two different layouts in the Microsoft Defender XDR portal. While the alert views may show different information, all alerts are based on detections from Defender for Identity sensors. The differences in layout and information shown are part of an ongoing transition to a unified alerting experience across Microsoft Defender products.

To learn more about how to understand the structure, and common components of all Defender for Identity security alerts, see View and manage alerts.

For information about True positive (TP), Benign true positive (B-TP), and False positive (FP), see security alert classifications.

Alerts categories

The alerts are divided into categories based on the phases seen in a typical cyber-attack kill chain. The categories differ slightly depending on whether the alert originates from using the classic Microsoft Defender for Identity alerting, or Microsoft Defender for XDR. The differences are part of an ongoing transition to a unified alerting experience across Microsoft Defender products.

For example, there are categories for:

• Reconnaissance and discovery alerts
• Persistence and privilege escalation alerts
• Credential access alerts
• Lateral movement alerts

For detailed information about each alert see:

• Microsoft Defender for Identity classic alerts
• Microsoft Defender for Identity XDR alerts

See Also

• View and manage security alerts
• Investigate security alerts
• Check out the Defender for Identity forum!