Manage a Security Operations Environment · Topic 1 of 8
Defender XDR Notifications and Endpoint Settings
SC-200 Defender XDR settings: email notifications, alert tuning, endpoint advanced features, rules settings, custom data collection and ASR rules.
- 6 min
- Email notifications exist for incidents, actions and threat analytics, and can be filtered by severity and device group.
- Alert tuning rules hide or resolve expected alerts, and correlation merges related alerts into one incident.
- Live response on servers needs both live response and live response for servers enabled.
What it is
A security operations team needs the right people told about the right events, and the right protection switched on for endpoints. In the Microsoft Defender portal you configure email notifications for incidents, actions and threat analytics, tune alerts so noise does not drown real threats, and set the advanced features, rules and security policies of Microsoft Defender for Endpoint.
How it works
Email notifications in Defender XDR
Notification rules send an email when something happens, so analysts do not have to watch the portal. In the Defender portal settings you can set up three kinds.
| Notification | What it tells you about |
|---|---|
| Incidents | A new incident or a change to one, filtered by severity, service source and device group |
| Actions | Pending or completed response actions in the Action center, such as an action waiting for approval |
| Threat analytics | A new threat report, or an update to one, that matters to your organisation |
Each rule has a name, the conditions that trigger it and a list of recipients. Use filters, for example only high severity incidents from Defender for Endpoint for one device group, so that people are not flooded. A distribution list is easier to manage than many individual addresses.
Alert notifications, tuning and suppression
Defender products raise many alerts, and some of them are expected in your environment. Alert tuning lets you handle those without hiding real threats.
- Alert tuning rules (also called suppression rules) match alerts by conditions such as the alert title, the device, the user or a file, and then take an action, for example hide the alert or resolve it automatically.
- You can scope a rule to specific devices or users, and set it to apply to existing alerts as well.
- Correlation groups related alerts into a single incident automatically, so an attack that touches email, an endpoint and an identity appears as one story and not as dozens of separate alerts.
Tune carefully. A rule that is too broad can suppress a real attack, so scope it narrowly and review it regularly.
Defender for Endpoint advanced features
Under Settings > Endpoints > General > Advanced features you switch capabilities on or off for the whole tenant. Common ones include:
| Feature | What it does |
|---|---|
| Live response and live response for servers | Lets analysts open a remote shell on a device. A separate setting enables it for servers |
| Live response unsigned script execution | Allows running scripts that are not signed |
| Automated investigation | Lets Defender investigate alerts and propose or take remediation |
| Restrict correlation to within scoped device groups | Keeps incidents inside the device groups that a team can see |
| EDR in block mode | Blocks malicious artifacts even when another antivirus is the primary one |
| Tamper protection | Stops malware or users from turning off security features |
| Allow or block file, custom network indicators | Enables indicators that block files, IP addresses and URLs |
| Device discovery | Finds unmanaged devices on the network |
| Web content filtering | Blocks categories of websites |
A frequent exam situation is an analyst who has the live response permission but cannot start a session on a server. Live response and the separate live response for servers setting must both be on.
Rules settings
Under Settings > Endpoints > Rules you manage:
- Indicators, which allow, block or alert on file hashes, IP addresses, URLs and domains, and certificates.
- Alert suppression rules.
- Web content filtering policies.
- Automation folder exclusions and automation uploads, which control what the automated investigation may inspect.
- Asset rule management, which tags and manages assets.
Custom data collection
Defender for Endpoint collects a large amount of telemetry by default, but some scenarios need extra data. Custom data collection lets you collect additional, specific events, with filters for properties such as folder paths, process names and network connections, so you get targeted visibility without the cost and noise of collecting everything. Typical uses are hunting for particular attack patterns, application monitoring, compliance evidence and incident response. The collected data appears in advanced hunting tables.
Security policies and attack surface reduction
Security policies for endpoints are usually deployed with Microsoft Intune (Endpoint security) or Group Policy. Attack surface reduction (ASR) rules block risky behaviour, for example Office applications creating child processes, scripts launching downloaded content, or credential stealing from the Windows security authority process.
Each ASR rule has a mode.
| Mode | Behaviour |
|---|---|
| Not configured | The rule is off |
| Audit | Logs what would be blocked, so you can test |
| Warn | Blocks but lets the user override |
| Block | Blocks the behaviour |
Deploy rules in audit mode first, review the events in advanced hunting, add exclusions for legitimate software, and only then move to block.
Choosing the setting
| The need | Setting |
|---|---|
| Tell the on call team about new high severity incidents | An incident email notification with a severity filter |
| Know when an action is waiting for approval | An actions email notification |
| Stop a harmless, expected alert from creating noise | An alert tuning rule scoped to the device |
| Let analysts open live response on servers | Live response and live response for servers |
| Collect PowerShell script events that are not collected by default | Custom data collection |
| Test blocking Office child processes safely | An ASR rule in audit mode |
A worked scenario
A SOC wants fewer low value alerts. An analyst notices that a backup tool triggers the same low severity alert on 40 servers every night, so a tuning rule hides that alert for those devices only. They add an incident notification for high severity incidents to the on call distribution list, and an actions notification so pending approvals are seen. For a hunt on suspicious PowerShell, they turn on custom data collection for script block events on a pilot device group. Finally they deploy ASR rules in audit mode through Intune and review the audit events before enforcing them.
What to remember for the exam
- Email notifications exist for incidents, actions and threat analytics, and can be filtered by severity and device group.
- Alert tuning rules hide or resolve expected alerts, and correlation merges related alerts into one incident.
- Live response on servers needs both live response and live response for servers enabled.
- Custom data collection adds targeted telemetry, which appears in advanced hunting.
- ASR rules have Audit, Warn and Block modes. Start in audit.
When an analyst has the right permission but a feature still fails, look for the tenant wide switch under Advanced features.
How the exam asks about this
- "Which notification tells you an action is waiting for approval?" An actions email notification.
- "Collect more detailed events from devices without collecting everything." Custom data collection.
- "Test an ASR rule before enforcing it." Audit mode.
- "An analyst cannot start live response on a Windows Server." Turn on live response for servers.
Common mistakes
Tuning too broadly. A wide suppression rule can hide a real attack.
Skipping audit mode for ASR. Blocking straight away can break legitimate software.
Forgetting the separate server setting. Live response and live response for servers are different switches.
Mixing up indicators and tuning rules. Indicators allow or block entities. Tuning rules manage alerts.
Check yourself
Which three kinds of email notification does Defender XDR offer?
Incidents, actions and threat analytics.
What is the safe way to roll out an ASR rule?
Deploy it in audit mode, review the events and add exclusions, then move to block.
What does custom data collection do?
It collects extra, filtered telemetry from Defender for Endpoint devices for hunting and investigation.
Topic 1 of 8 in Manage a Security Operations Environment
Test yourself on Manage a Security Operations Environment
The full Microsoft SC-200 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.