Due to the scoring of MDCA being discontinued, if we need to retain the TOP 10 users using UEBA, what methods can we use?

Question

Due to the scoring of MDCA being discontinued, if we need to retain the TOP 10 users using UEBA, what methods can we use?

'Investigation priority score' feature and 'Investigation priority score increase policy' will be phased out in the coming weeks, This will impact all existing related policies, as they will be removed.

Answer 1

Hi @Koonnamchok Klongkaew

To the best of my knowledge the change you're referring to is only affecting to the Investigation priority score alert in Defender for Cloud Apps. You can still use MDA UEBA as before and investigation score remains in the product after the change.

MS Learn states the following:

We're gradually retiring the Investigation priority score increase alert from Microsoft Defender for Cloud Apps by August 2024. The investigation priority score and the procedure described in this article are not affected by this change.

Details - https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-anomaly-alerts#deprecation-timeline

If you want to leverage the investigation priority score alerts in the future I suggest you to use the hunting query mentioned on the article (instead of policy template) and adjust that one based on your needs.