Question

A SOC analyst receives an alert that a newly disclosed ransomware campaign is targeting organizations in their industry. Leadership wants to know two things quickly: whether the organization is already impacted by this specific threat, and which of their devices lack the recommended mitigations. The analyst wants to use a single Microsoft Defender XDR capability that provides curated intelligence about the campaign along with tenant-specific impacted assets and exposure data. Which capability should the analyst use?

Accepted Answer

Open the Threat analytics report for the campaign and review its Impacted assets and Exposure & mitigations tabs

Answer

Run an ad-hoc Advanced Hunting query against the DeviceInfo table filtering on OS build numbers

Answer

Create a custom detection rule scoped to the campaign's known indicators of compromise

Answer

Open the Microsoft Defender Vulnerability Management dashboard and review the exposure score trend