Question

A SOC analyst is reviewing a Microsoft Defender XDR incident that correlates a Defender for Cloud Apps 'Impossible travel' alert with an Entra ID sign-in from a new country and a subsequent Exchange Online inbox rule creation for a finance department user. The analyst needs to confirm whether the account is genuinely compromised before taking response actions, without disrupting the user if the activity is legitimate. Which investigative step should the analyst take FIRST to validate the compromise?

Accepted Answer

Examine the incident's user entity page and correlated evidence, reviewing the sign-in logs for MFA status, IP reputation, and device details around the anomalous activity.

Answer

Immediately confirm the user as compromised in Defender XDR to trigger automatic attack disruption and revoke all sessions.

Answer

Create a Defender for Cloud Apps session policy to block downloads for the user before any further review.

Answer

Run a Purview eDiscovery content search across the entire tenant to locate any exfiltrated finance documents.