メインコンテンツへスキップ

Review & Remediate Attack Paths Risks

Implementation Effort: Medium
Security and IT teams must analyze attack path graphs, identify choke points, and apply prioritized remediations across hybrid and multicloud environments.

User Impact: Low
Attack path analysis and remediation are handled by administrators and security teams; end users are not directly involved.

Overview​

Attack path analysis in Microsoft Defender for Servers, via Microsoft Defender for Cloud and Security Exposure Management, helps identify and visualize potential routes attackers could exploit to compromise critical assets. These paths are built using real-time data from vulnerabilities, misconfigurations, excessive permissions, and exposed services.

Key Capabilities​

  • Visualizes entry points, choke points, and target assets.
  • Highlights blast radius to show how a compromised asset could impact others.
  • Provides actionable recommendations to break or mitigate attack paths 1 2.

How to Review Attack Paths​

  1. Go to Microsoft Defender for Cloud > Attack paths.
  2. Use the dashboard to view:
    • Top attack paths
    • Entry points and target assets
    • Choke points and blast radius 1
  3. Select an attack path to:
    • Hover over nodes to view asset details
    • Understand how the path is constructed
    • Identify lateral movement risks 3

How to Remediate​

  1. Open the Recommendations tab within the attack path view.
  2. Sort by risk level, target criticality, or entry point type.
  3. Select a recommendation and click Manage to open the remediation interface.
  4. Apply fixes such as:
    • Removing excessive permissions
    • Closing exposed ports
    • Patching vulnerable software
    • Reconfiguring network segmentation 1

Additional Tools​

  • Security Explorer: Enables querying and filtering of attack paths by asset type, exposure, and risk.
  • Blast Radius View: Helps assess the broader impact of a compromised asset and prioritize mitigation 1.

Failing to review and remediate attack paths can leave critical systems exposed to chained exploits and lateral movement. This capability supports the "Assume Breach" and "Use Least Privilege Access" principles of Zero Trust by proactively identifying and disrupting potential attack vectors.

Reference​