Manage alerts (Microsoft)

This article explains how to work with alerts raised in the Defender for Cloud Apps portal.

Manage your alerts

Alerts are the entry points to understanding your cloud environment more deeply. You might want to create new policies based on what you find. For example, you might see an administrator signing in from Greenland, and no one in your organization ever signed in from Greenland before. You can create a policy that automatically suspends an admin account when it’s used to sign in from that location.

It’s a good idea to review all of your alerts and use them as tools for modifying your policies. If harmless events are being considered violations to existing policies, refine your policies so that you receive fewer unnecessary alerts.

1. From the Alerts page, select Open for the Resolution Status.

   This section of the dashboard provides full visibility into any suspicious activity or violation of your established policies. It can help you safeguard the security posture you defined for your cloud environment.

   

2. For each alert, you need to investigate and determine the nature of the violation and the required response.
   • You can filter the alerts by Alert type or by Severity to process the most important ones first.
   • Select a specific alert. Depending on what type of alert it is, you’ll see various actions that can be taken before resolving the alert.
   • You can filter based on App – The apps listed are ones for which activities were detected by Defender for Cloud Apps.
   • There are three types of violations you’ll need to deal with when investigating alerts:
     • Serious violations – Serious violations require immediate response.
       Examples:
       • For a suspicious activity alert, you might want to suspend the account until the user changes their password.
       • For a data leak you might want to restrict permissions or quarantine the file.
       • If a new app is discovered, you might want to block access to the service on your proxy or firewall.
     • Questionable violations – Questionable violations require further investigation.
       • You can contact the user or the user’s manager about the nature of the activity.
       • Leave the activity open until you have more information.
     • Authorized violations or anomalous behavior – Authorized violations or anomalous behavior can result from legitimate use.
       • You can dismiss the alert.
3. When you dismiss an alert, it’s helpful if you submit feedback about why you’re dismissing the alert. The Defender for Cloud Apps team uses this feedback as an indication of the accuracy of the alert. This information is then used to fine-tune our machine learning models for future alerts. If you check the It’s OK to contact me about this alert box, in select cases we may get back to you for additional information. You can follow these guidelines in deciding how to categorize the alert:
   • If legitimate use triggered the alert and it isn’t a security issue, it could be one of these types:
     • Benign positive: The alert is accurate but the activity is legitimate. You can dismiss the alert and set the reason to Actual severity is lower or Not interesting.
     • False positive: The alert is inaccurate. Dismiss the alert and set the reason to Alert is not accurate.
   • If there’s too much noise to determine the legitimacy and accuracy of an alert, dismiss it and set the reason to Too many similar alerts.
   • True positive: If the alert is related to an actual risky event that was either committed maliciously or unintentionally by an insider or outsider, you should set the event to Resolve after all appropriate action has been taken to remediate the event.

Alert types

The following table provides a list of the types of alerts that can be triggered and recommends ways you can resolve them.