Alerts (security events)
One queue for things that just happened on customers' devices and cloud tenants, and how to work it.
Updated
Alerts is one queue for things that just happened: malware Microsoft Defender found, someone added to Administrators, an event log cleared, an RDP login from the internet, a Microsoft 365 alert or risky sign-in, a new Global Administrator, an app given access to mailboxes, a ThreatLocker computer left in Learning mode. It's for your MSP team only.
Repeats of the same thing are counted on one alert, so the queue grows with distinct problems, not with log volume.
Sources
| Source | Reports | Needs |
|---|---|---|
| Microsoft Defender | Detections from Defender Antivirus on the device | RevoAgent 0.3.0 or later on Windows |
| Windows event log | Selected Security, System and Defender events | Agent 0.3.0+ on Windows |
| Linux auth log | SSH, sudo and account changes | Agent 0.3.0+ on Linux |
| Microsoft 365 | Security alerts, risky users and sign-ins, admin role and app changes | A Microsoft 365 connection with the security permissions |
| ThreatLocker | Detect and Cyber Hero MDR threats on computers and Microsoft 365 accounts, computers left in Learning mode, approval requests waiting | The ThreatLocker integration (see Detect and MDR alerts) |
You don't need Defender for Endpoint: Defender data comes from the standard Defender Antivirus built into Windows, read by the agent. Free-text event messages, command lines and passwords are never collected.
If the page is empty, it says what's missing: install or update the agent, or reconnect Microsoft 365 to grant the security permissions.
What gets raised
A few examples of how events are judged:
| Event | Severity |
|---|---|
| Audit log cleared | Critical |
| Malware still active (Defender severe/high threat) | Critical |
| Global Administrator or Privileged Role Administrator assigned | Critical |
| User added to a privileged group (Administrators, Domain Admins, sudo/wheel…) | High |
| Defender protection disabled | High |
| RDP or SSH login from a public IP address | High |
| 20 or more failed logons for one user from one source (200+ is high) | Medium |
| New service installed | Medium |
| ThreatLocker computer in Learning mode for more than 14 days | Medium |
| ThreatLocker Detect threat | ThreatLocker's severity: Severe is high, Warning medium, Information low |
A handful of failed logons is normal and isn't stored. Logons from the LAN or VPN aren't stored.
Statuses
| Status | Meaning | If it happens again |
|---|---|---|
| New | Nobody has looked yet | The count goes up |
| Acknowledged | Someone is on it | The count goes up; it returns to New if it gets more severe |
| Resolved | Dealt with, by you or by the source | It reopens for newer activity |
| Dismissed | Expected or harmless ("our backup software installs a service") | It stays quiet unless it gets more severe |
Use the row actions, or select several, to Acknowledge, Resolve or Dismiss them together. Every change is audited.
Many alerts resolve themselves: Defender removed the threat, Microsoft resolved the alert, the user is no longer risky, the computer left Learning mode.
Work an alert
- Filter by source, severity, status and time. Enter a customer's workspace to see only theirs.
- Open the alert for what happened, why it matters and what to do, with the device, customer and any related finding.
- Acknowledge it while you investigate, then resolve or dismiss it with a reason.
Notifications
One notification per customer per run lists new high and critical alerts; critical ones are emailed too, to the
workspace's alert recipients. Alerts whose latest occurrence is more than 72 hours old don't notify, so an upgraded
agent's history doesn't page anyone. Webhooks receive security_event.detected. See
Notifications.
Alerts and findings
Lasting bad states also become findings, which resolve when fixed: Defender signatures more than 3 days old, no scan in 14 days, tamper protection off, an active or unremediated threat. See Triage workflow.