Two Microsoft Defender for Identity Alerts Missing Content

Question

Two Microsoft Defender for Identity Alerts Missing Content

Anonymous

Hello,

Two Defender for Identity alerts that we get regularly come in with almost no information. We believe there is something wrong with the sensor but don't have visibility on it.

Account enumeration reconnaissance (on one endpoint)
remote code execution (on one endpoint)

Does anyone know what needs to be tweaked in order to enrich these alerts? It's been quite challenging to address them. Thank you!

Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2022-06-08T23:25:45.303+00:00

Which details are you hoping to surface? If the connection was attempted via RDP an IP address would not be found in this case.

If you think there is something wrong with the Connector Health you could do a health check to confirm.

You can also create a rule to see custom details.

Your answer

Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2022-06-08T23:25:45.303+00:00

Which details are you hoping to surface? If the connection was attempted via RDP an IP address would not be found in this case.

If you think there is something wrong with the Connector Health you could do a health check to confirm.

You can also create a rule to see custom details.

Share via

Two Microsoft Defender for Identity Alerts Missing Content

Your answer