Microsoft Defender for Identity security alerts have been triaged and tuned

Overview

Microsoft Defender for Identity alerts on Kerberoasting, DCSync, suspicious LDAP enumeration, and other directory attacks. When these alerts are not triaged and tuned, two outcomes follow: real intrusions are missed because the queue is dominated by benign noise, and the noise is never reduced using known sensitive groups, allow-listed service accounts, and excluded subnets. A threat actor benefits from both outcomes — their reconnaissance and credential theft blends into the unhandled backlog, and the time between alert and response stretches past the window in which containment is still possible. Microsoft Defender for Identity provides per-alert tuning controls and a classification workflow that feeds back into the detection model; this check confirms the open Defender for Identity alert backlog has been worked and that recurring benign sources have been excluded so genuine intrusions surface promptly. Because no Microsoft Graph API exposes Defender XDR alert tuning or suppression rule configuration, this check uses classification activity over the trailing 30 days as a proxy for tuning discipline: it passes when at least 80 percent of MDI alerts are classified and no alert older than seven days remains new and unclassified.

Remediation

• Microsoft Defender for Identity alert categories
• Tune alerts in Microsoft Defender XDR
• Microsoft Defender XDR alert tuning

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Identity threat protection
Product	Defender
Feature	Defender for Identity
Area	Logging and detection
ATT&CK	T1558.003 Kerberoasting, T1003.006 DCSync, T1087.002 Domain Account
Licence	ATA
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.