Unified detections in Defender XDR
Something detection engineers (working with Defender XDR) has been waiting for is being able to use other static data to enrich queries. In Sentinel we have been able to use watchlists for a long time but on the Defender side this has been missing.
Some short updates (this give value):
_GetWatchlist('ExcludedIPs')
So what happens when you configure a new detection?
The detection wizard is showing and one of the new things here is the Frequenzy “Custom” which is familiar from a Sentinel perspective.
When it comes to lookback time, there are a few things to know:
https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules
In the next step, the Alert settings we have the opportunity to dynamically set the Provider name and other custom details (key value pairs)
We can also do detailed entity mapping as well as “Related Evidence” mapping. This means Entities that are related to the alert, but are not impacted assets.
Depending on data source we can also configure automated actions (as before).
We recommend you to AVOID doing isolate device as an automated action, things can go wrong fast.
Comparison between Analytics rules and custom detections: Compare Microsoft Sentinel analytics rules and Microsoft Defender custom detections – Microsoft Security | Microsoft Learn
#Happy Hunting