# Microsoft Defender for Identity security alerts have been triaged and tuned
Microsoft Defender for Identity alerts on Kerberoasting, DCSync, suspicious LDAP enumeration, and other directory attacks.
Source: https://maester.dev/docs/tests/ZTA.41022
## Overview
Microsoft Defender for Identity alerts on Kerberoasting, DCSync, suspicious LDAP enumeration, and other directory attacks. When these alerts are not triaged and tuned, two outcomes follow: real intrusions are missed because the queue is dominated by benign noise, and the noise is never reduced using known sensitive groups, allow-listed service accounts, and excluded subnets. A threat actor benefits from both outcomes — their reconnaissance and credential theft blends into the unhandled backlog, and the time between alert and response stretches past the window in which containment is still possible. Microsoft Defender for Identity provides per-alert tuning controls and a classification workflow that feeds back into the detection model; this check confirms the open Defender for Identity alert backlog has been worked and that recurring benign sources have been excluded so genuine intrusions surface promptly. Because no Microsoft Graph API exposes Defender XDR alert tuning or suppression rule configuration, this check uses classification activity over the trailing 30 days as a proxy for tuning discipline: it passes when at least 80 percent of MDI alerts are classified and no alert older than seven days remains new and unclassified.
## Remediation
- [Microsoft Defender for Identity alert categories](https://learn.microsoft.com/en-us/defender-for-identity/alerts-overview?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- [Tune alerts in Microsoft Defender XDR](https://learn.microsoft.com/en-us/defender-xdr/investigate-alerts?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- [Microsoft Defender XDR alert tuning](https://learn.microsoft.com/en-us/defender-xdr/investigate-alerts?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#tune-an-alert)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Identity threat protection |
| Product | [Defender](/docs/tests/products/defender) |
| Feature | Defender for Identity |
| Area | Logging and detection |
| ATT&CK | [T1558.003](/docs/tests?mitre=T1558.003) Kerberoasting, [T1003.006](/docs/tests?mitre=T1003.006) DCSync, [T1087.002](/docs/tests?mitre=T1087.002) Domain Account |
| Licence | ATA |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.