An alert will be triggered when there is evidence of suspicious Kerberos delegation attempts using the BronzeBit method, where a user has attempted to use a ticket to delegate access to a particular resource.
One of the most widely used features relating to alerting in Defender for Identity is being able to tune them and make sure you are only alerted on what should be getting your attention. With the exclusion capability landing in Microsoft 365 security center for Defender for Identity, you can tune the alerts and filter the detections based on entities that matter to you. We are also improving the experience in the allow-list functionality, making sure you can allow entities across all detections as opposed to allowing them per detection.
An alert will be triggered when there is evidence of suspicious Kerberos delegation attempts using the BronzeBit method, where a user has attempted to use a ticket to delegate access to a particular resource.
As part of the ongoing work to improve the experience of Security Operations professionals and consolidate the functionality of multiple portals into a single space that SecOps can interact with their threat and incident data, Defender for Identity’s administrative functions will be available to view and edit within the Microsoft 365 security center. In this time frame, you can expect to see the following functions and features be made available in the Microsoft 365 security center: Defender for Identity onboarding, VPN configuration, email notifications, sensor deployment and sensor health, entity tagging and SIEM configuration.
I've been working with Microsoft Technologies over the last ten years, mainly focused on creating collaboration and productivity solutions that drive the adoption of Microsoft Modern Workplace.
Found my content useful?
Buy Me a Beer
HANDS ON SharePoint
HANDS ON Teams
HANDS ON Lists
HANDS ON tek
M365 Admin
