Skip to main content Link Menu Expand (external link) Document Search Copy Copied
Defender for Identity

Task 4.5: Investigate a credential access alert

Microsoft Defender for Identity is a tool used to discover and analyze attacks. This is an important feature that will help ensure that your environment is secure. Please take your time when analyzing these attacks to become comfortable with their capabilities.

  1. Switch to the DC01 RDP session, in the browser, if you are not already, go to https://security.microsoft.com.

  2. Under Incidents & alerts, select Alerts.

  3. Locate the Security principal reconnaissance (LDAP) alert.

  4. Select the Security principal reconnaissance (LDAP) alert to show the details page.

    SPR_MainAlert.jpg

    It can take several minutes for the alert to appear. Wait a few minutes, and then refresh the browser. If you don’t see the alert, you can continue to the next section and return to investigate the alert in a few minutes.

  5. Review the information regarding the Alert story on the details page.

  6. Review the options on the blade on the right side of the details page

    SPR_InvestigateBlade2.jpg

  7. Under the Incident details, select the Incident link.

  8. Review the Incident details page to discover related attacks. This will display additional alerts from the same user or machine.

  9. Review the Incident graph.

    SPR_IncidentGraph.jpg

  10. Select each object in the Incident graph, and then select Device details to display information relating to the object.

  11. When finished reviewing the Device details, scroll back to the top, and then select Back to incident details.

    IP_Recon_BackToDetails.jpg

  12. Under RELATED THREATS, select View threat analytics report, and then review the details of the report.

    SPR_RelatedThreats.jpg

  13. Close the Threat Analytics tabs and return to the Incident-Microsoft Defender tab.

  14. Select the Alerts tab, and then select the Security principal reconnaissance (LDAP) to return to the alert details page.

  15. On the right panel, select Manage alert.

    IP_Recon_ManageAlert.jpg

  16. On the Manage alert blade, configure the options according to the following table.

    Heading Value
    Status In progress
    Assigned to AlexW
    Classification True poitive/Other
    Comment Attack initiated from WIN5. Requires further investigation. It has been assigned to Alex Wilbur.

  17. Select Save, and then close the Manage alert blade.