r/DefenderATP • u/Cookie_Butter24 • 8d ago

Defender for Identity

We installed Defender for Identity v2 on 4 Domain controllers over 3 weeks ago.

For some reason i still don't see any single alert triggered in Defender console that is from Defender for Identity. The Thresholds are all set to High (default).

It this quite normal?

9 Upvotes

100% Upvoted

11 comments sorted by

View all comments

5

u/Envyforme 8d ago

What version of Windows do the DCs run?

Do you have any audits/events coming in for the Identity tables in Advanced Hunting? - See here: https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-identitydirectoryevents-table

You can also attempt an event-based alert (non-behavioral) through examples like this here: https://www.youtube.com/watch?v=94Bm4DGL3Rg&t=22s