Question

During a threat hunt, your SOC receives a Microsoft Defender XDR threat analytics report for an emerging ransomware campaign. Leadership asks you to quickly determine whether your organization already has any active or historical alerts and incidents tied to this specific threat, without manually writing KQL. Which capability within the threat analytics report should you use first?

Accepted Answer

The 'Related incidents' tab of the threat analytics report, which surfaces incidents and alerts in your tenant already correlated to that threat

Answer

The 'Endpoints exposure' tab, which lists devices missing recommended security configurations

Answer

The 'Recommended actions' tab, which shows configuration changes to mitigate the threat

Answer

Build a custom detection rule referencing the report's indicators and wait for it to trigger