Protective Security Monitoring

1 Alert Monitoring Workflows

Standardized monitoring workflows ensure consistent coverage across shifts and reduce the risk of missed detections. These checklists and procedures define the minimum operational expectations for SOC analysts monitoring Microsoft Defender for Endpoint.

Shift Handover Procedure

Daily Monitoring Checklist

Alert Queue Management

2 MDE Secure Score

Microsoft Secure Score for Devices provides a quantitative measure of your endpoint security posture. Regular monitoring and improvement of this score reduces attack surface and strengthens defensive coverage across the fleet.

Secure Score Review Procedure

1. Navigate to Microsoft 365 Defender portal → Secure Score
2. Review current Exposure Score (lower is better) and Secure Score for Devices
3. Identify top security recommendations sorted by impact
4. Assess implementation feasibility for each recommendation
5. Create remediation tickets for approved recommendations
6. Track implementation progress weekly
7. Report Secure Score trends to management monthly

Devices Not Meeting Secure Configuration

DeviceTvmSecureConfigurationAssessment
| where IsCompliant == 0
| where IsApplicable == 1
| summarize NonCompliantCount = count(),
            Devices = make_set(DeviceName, 10)
    by ConfigurationId, ConfigurationName, ConfigurationCategory
| sort by NonCompliantCount desc
| take 20

Configuration Compliance Trend

DeviceTvmSecureConfigurationAssessment
| where Timestamp > ago(30d)
| summarize CompliantCount = countif(IsCompliant == 1),
            TotalCount = count()
    by bin(Timestamp, 1d)
| extend ComplianceRate = round(CompliantCount * 100.0 / TotalCount, 1)
| project Timestamp, ComplianceRate, CompliantCount, TotalCount
| sort by Timestamp asc

3 ASR Rules Monitoring

Attack Surface Reduction (ASR) rules are critical preventive controls in Microsoft Defender for Endpoint. Monitoring ASR events ensures rules are operating as expected, identifies candidates for mode promotion (Audit to Block), and surfaces potential business impact from blocked legitimate activities.

ASR Rules Reference

ASR KQL Queries

ASR Events Summary (Last 30 Days)

DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| summarize EventCount = count() by ActionType
| sort by EventCount desc

ASR Blocked Events with Process Details

DeviceEvents
| where Timestamp > ago(7d)
| where ActionType startswith "Asr"
| where ActionType endswith "Blocked"
| project Timestamp, DeviceName, ActionType, FileName,
         FolderPath, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 100

ASR Audit Events — Candidates for Block Mode

DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| where ActionType endswith "Audited"
| summarize AuditCount = count(),
            Devices = dcount(DeviceName),
            SampleFiles = make_set(FileName, 5)
    by ActionType
| sort by AuditCount desc

Top ASR-Triggering Applications

DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| summarize TriggerCount = count(),
            Rules = make_set(ActionType)
    by FileName, FolderPath
| sort by TriggerCount desc
| take 25

ASR Rule Coverage per Device

DeviceEvents
| where Timestamp > ago(7d)
| where ActionType startswith "Asr"
| summarize ActiveRules = dcount(ActionType),
            RuleList = make_set(ActionType)
    by DeviceName
| sort by ActiveRules asc

4 EDR Telemetry Reference

Microsoft Defender for Endpoint collects telemetry across multiple data tables in Advanced Hunting. Understanding the purpose, key fields, and common use cases for each table is essential for effective threat hunting and alert investigation.

5 Baseline Monitoring KQL Queries

Baseline monitoring identifies deviations from normal environment behavior. These queries compare recent activity against established baselines to surface anomalous processes, network connections, file operations, and authentication patterns that warrant investigation.

Unusual Process Execution (First Seen)

let knownProcesses = DeviceProcessEvents
    | where Timestamp between (ago(30d) .. ago(1d))
    | distinct FileName;
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName !in (knownProcesses)
| summarize FirstSeen = min(Timestamp),
            Devices = make_set(DeviceName, 5),
            DeviceCount = dcount(DeviceName),
            CommandLines = make_set(ProcessCommandLine, 3)
    by FileName, InitiatingProcessFileName
| sort by DeviceCount asc

Anomalous Outbound Network Connections

let baselineIPs = DeviceNetworkEvents
    | where Timestamp between (ago(30d) .. ago(1d))
    | where RemoteIPType == "Public"
    | distinct RemoteIP;
DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemoteIPType == "Public"
| where RemoteIP !in (baselineIPs)
| summarize ConnectionCount = count(),
            Devices = make_set(DeviceName, 5),
            Ports = make_set(RemotePort),
            Processes = make_set(InitiatingProcessFileName)
    by RemoteIP
| sort by ConnectionCount desc
| take 50

Suspicious File Creation in Temp Directories

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FolderPath has_any (@"\Temp\", @"\tmp\", @"\AppData\Local\Temp", @"C:\Windows\Temp")
| where FileName endswith ".exe" or FileName endswith ".dll"
    or FileName endswith ".ps1" or FileName endswith ".bat"
    or FileName endswith ".vbs" or FileName endswith ".hta"
| project Timestamp, DeviceName, FileName, FolderPath, SHA256,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

Registry Run Key Modifications

DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType == "RegistryValueSet"
| where RegistryKey has_any (
    @"CurrentVersion\Run",
    @"CurrentVersion\RunOnce",
    @"CurrentVersion\Explorer\Shell Folders",
    @"CurrentVersion\Winlogon"
)
| project Timestamp, DeviceName, RegistryKey, RegistryValueName,
         RegistryValueData, InitiatingProcessFileName,
         InitiatingProcessCommandLine, AccountName
| sort by Timestamp desc

Failed Logon Attempts Spike

DeviceLogonEvents
| where Timestamp > ago(24h)
| where ActionType == "LogonFailed"
| summarize FailedCount = count(),
            UniqueAccounts = dcount(AccountName),
            Accounts = make_set(AccountName, 10)
    by DeviceName, bin(Timestamp, 1h)
| where FailedCount > 10
| sort by FailedCount desc

Unsigned DLL Loads in System Processes

DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in ("svchost.exe", "lsass.exe", "services.exe", "explorer.exe")
| where InitiatingProcessFolderPath startswith @"C:\Windows\System32"
| where not(FolderPath startswith @"C:\Windows")
| project Timestamp, DeviceName, FileName, FolderPath, SHA256,
         InitiatingProcessFileName, InitiatingProcessFolderPath
| sort by Timestamp desc

PowerShell Encoded Command Execution

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("-enc", "-EncodedCommand", "-e ", "FromBase64")
| project Timestamp, DeviceName, ProcessCommandLine, AccountName,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

Tamper Protection Events

DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "TamperProtection"
| project Timestamp, DeviceName,
         TamperAction = tostring(AdditionalFields.TamperAction),
         TamperTarget = tostring(AdditionalFields.TamperTarget),
         InitiatingProcessFileName, AccountName
| sort by Timestamp desc

6 Alert Tuning Procedures

Alert tuning reduces false positive noise while maintaining detection coverage. A disciplined tuning process ensures that suppression rules are well-documented, regularly reviewed, and do not inadvertently mask real threats.

Tuning Procedure Steps

1. Identify alert generating excessive false positives (>20% FP rate over 7 days)
2. Analyze FP patterns — common file, process, path, or user
3. Determine appropriate tuning action (suppression, exclusion, custom detection modification)
4. Document tuning rationale and expected impact
5. Implement tuning in MDE portal (suppression rules, indicators with Allow action)
6. Monitor for 7 days to validate tuning effectiveness
7. Verify true positives are not being suppressed

Alert Quality Metrics

7 False Positive Reduction

Systematic false positive reduction improves analyst efficiency, reduces alert fatigue, and allows the team to focus on genuine threats. This section provides a decision tree for FP classification and a documentation template for suppression rules.

FP Decision Tree

• ALERT RECEIVED — Begin FP Assessment
  • Is the activity from a known legitimate application?
    • YES — Is it in the approved software list?
      • YES — Document as FP, create suppression rule
      • NO — Escalate for software approval review
    • NO — Is it a known testing/admin activity?
      • YES — Verify with activity owner
        • Confirmed legitimate — Document as BTP, consider suppression
        • Not confirmed — Continue investigation
      • NO — Continue full investigation

FP Documentation Template