Every open Microsoft Defender XDR alert is triaged across all Defender services, with no high-severity alert left unassigned or unworked past its triage window

Overview

Organizations rely on Microsoft Defender to catch attacks early, but a detection only helps if someone acts on it. A Defender alert is a signal that Defender found a malicious or suspicious event, such as a phishing email, a compromised sign-in, malware on a device, or risky activity in a cloud app. Microsoft Defender XDR collects these alerts from every connected Defender service into one unified queue, exposed through the Microsoft Graph alerts_v2 API, and correlates related alerts into incidents that tell the full story of an attack. Each alert is one piece of that story, so an open alert that no analyst has assigned or worked is a detected step of an active attack that no one has answered yet. From there the risk follows a familiar path: a threat actor gains a first foothold, sets up a way to return, gains higher-level access, moves to other accounts and devices, and finally steals data or launches ransomware. Because Defender often alerts early in an attack, the longer a high-severity alert sits unassigned and unworked, the more of this chain a threat actor can complete before anyone responds, and the larger the breach becomes. A tenant can run a separate check for each product and have all of them pass, yet still miss the alert that matters, because none of those checks look across every service at once, and one unwatched queue lets a whole class of attacks run unopposed. This check reads the triage signals that Defender records on every open alert — whether it is assigned, whether it is being worked, whether an analyst has classified it, and how long it has waited — across all Defender services together, and it fails when any high-severity alert stays untriaged past a set time window, so no Defender alert is left unanswered. It measures response, not the quality of an investigation, and its time windows are settings an operator can tune, not a service level that Microsoft defines.

Remediation

• Prioritize incidents in the Microsoft Defender portal
• Plan an incident response workflow in the Microsoft Defender portal
• Investigate alerts in Microsoft Defender XDR
• Manage incidents in Microsoft Defender XDR
• List alerts_v2

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Incident response operations
Product	Defender
Feature	Tenant settings
Area	Logging and detection
Licence	WINDEFATP, MDE_LITE, ATP_ENTERPRISE, THREAT_INTELLIGENCE, ATA, ADALLOM_S_STANDALONE
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.