メインコンテンツへスキップ

Determine Response Strategy

Implementation Effort: Medium — Defining a response strategy requires coordination between security operations, platform teams, and automation tooling, along with ongoing tuning and testing.

User Impact: Low — Response strategies are executed by security teams and automation systems, with no direct impact on end users unless containment actions are triggered.

Overview​

A well-defined response strategy in Microsoft Defender for Cloud ensures that alerts and incidents across App Service, Key Vault, and Resource Manager are handled consistently, quickly, and effectively. This strategy should include triage, investigation, containment, eradication, recovery, and post-incident learning.

Key Components of the Response Strategy​

1. Triage and Prioritization​

  • Use the incident queue in the Microsoft Defender portal to identify high-priority incidents.
  • Filter by severity, affected resources, and alert type to focus on the most critical threats 1.

2. Investigation​

  • Use the attack story and alert story views to understand the scope and origin of the incident.
  • Investigate impacted entities such as App Services, Key Vaults, or Resource Manager operations.
  • Leverage the Evidence and Response tab to gather supporting data 1.

3. Containment and Eradication​

  • For App Service: Disable compromised apps or enforce secure configurations.
  • For Key Vault: Revoke access or rotate secrets if suspicious access is detected 2.
  • For Resource Manager: Remove unauthorized role assignments or block malicious IPs 1.

4. Recovery​

  • Restore affected services to a known good state.
  • Re-enable services only after verifying that threats have been removed.

5. Post-Incident Learning​

  • Document the incident, response actions, and lessons learned.
  • Update playbooks and automation workflows.
  • Use Threat Analytics to understand broader attack trends 1.

This strategy supports all three Zero Trust principles:

  • Verify Explicitly: Investigate every alert with context.
  • Use Least Privilege Access: Remove unnecessary permissions during containment.
  • Assume Breach: Treat every alert as a potential compromise and respond accordingly.

Reference​