Question

A SOC analyst reads a Microsoft Defender XDR threat analytics report about a newly tracked ransomware operator. The report lists file hashes, malicious domains, and specific process command lines associated with the campaign. The analyst wants to quickly determine whether any managed devices in the environment have already encountered these indicators, without manually copying each IOC into a KQL query. What is the most efficient way to accomplish this?

Accepted Answer

Use the 'Related incidents', 'Impacted assets', and 'Prevented email attempts' tabs plus the built-in advanced hunting queries in the threat analytics report to identify affected devices

Answer

Manually build a DeviceFileEvents query joining DeviceNetworkEvents and DeviceProcessEvents, pasting each IOC from the report into a where clause

Answer

Create a custom detection rule for each indicator and wait for alerts to generate before scoping impact

Answer

Export the threat analytics report to CSV and upload the IOCs to the Sentinel threat intelligence connector for matching