2.7. Reflection Checkpoint

Key Takeaways

• Platform first: grant the smallest Sentinel role at the workspace's resource group (Responder plus Playbook Operator for analysts, Contributor plus Logic App Contributor for engineers), grant the Sentinel service account rights on playbook resource groups, keep detection data in the analytics tier and long-term data in the lake, and let SOC optimization point out wasted data and missing coverage.
• Ingestion is a pipe: source, collection mechanism (AMA with DCRs, never the retired legacy agent), rule, and table. Windows events via AMA land in SecurityEvent and WEF data in WindowsEvent; CEF and Syslog arrive through a Linux forwarder into CommonSecurityLog and Syslog; Azure Activity logs scale with Azure Policy plus remediation; threat indicators need a matching rule; custom tables need a DCR.
• Defender for Endpoint configuration decides what the SOC can see and do: advanced features enable capabilities like live response and file blocking, custom data collection adds telemetry to DeviceCustom* tables in Sentinel, ASR rules move from audit to block, and device groups (highest rank wins) set access and automation level.
• Defender XDR automation buys back time: notifications route attention, alert tuning removes known-benign noise without blocking anything, AIR investigates and remediates within automation levels via the Action center, and attack disruption contains high-confidence attacks automatically when its prerequisites are met.
• Detections and automation close the loop: custom detections can respond directly on Defender data, scheduled and NRT rules turn workspace KQL into alerts with entity mapping and grouping, anomalies inform rather than alert, automation rules dispatch incidents in strict order, and playbooks orchestrate external systems under their own identities.

Connecting Forward

Phase 3 moves from building the platform to using it under pressure: triaging and managing incidents in Defender XDR, investigating multi-stage attacks and lateral movement, responding to email, identity, cloud app, data, and cloud workload threats, taking device response actions in Defender for Endpoint, and investigating Microsoft 365 activity with Purview Audit, Content search, and Microsoft Graph activity logs.

Self-Check Questions

• An analytics rule should page the on-call engineer through Teams for every high-severity ransomware incident, and analysts must be able to rerun that playbook manually but never edit it. List every role assignment and automation component required, and who or what each one is assigned to.
• A finance server group requires approval for all remediation, yet attack disruption contained one of its servers automatically during an attack. Is that a misconfiguration? Explain how device group automation levels and attack disruption interact, and what you'd change if the business insists on no automatic containment for those servers.
• A team wants alerts within a minute for any sign-in from a known malicious IP in its TAXII feed. Walk through the data path (connector, tables) and the detection choice, and explain why ingesting the feed alone produces no alerts.