How to know who changed the status in Defender for cloud Security alert

Question

My team members are changing the status of security alerts in Defender for cloud. How can i check who worked on which alert ?

Answer 1

Hi @Rakesh Kumar , you should be able to use Azure Activity Log. You can filter the Activity Log to find entries related to security alerts and see who made the changes.

If you have connected Microsoft Defender for Cloud to a Log Analytics workspace, you can query the SecurityAlert table to find details about the alerts and the actions taken. You can use the following query to get information about the alerts:

   SecurityAlert
| where ProductName == "Azure Security Center"
| project TimeGenerated, AlertName, AlertSeverity, Status, ChangedBy