Study guide
Technical reference and lesson notes
Purpose of This Lesson
This lesson focuses on two important Microsoft Defender capabilities for security operations analysts:
- Threat analytics in Microsoft Defender, which helps analysts understand current threats, campaigns, vulnerabilities, and attacker techniques.
- Custom alert policies, which allow an organization to generate alerts when specific security-relevant activity occurs.
For the SC-200 exam, this topic matters because a Microsoft Security Operations Analyst must know how to monitor active threats, determine whether the organization is affected, review recommended actions, and configure alerting so important activity is surfaced quickly.
In a real SOC, these features support threat awareness, alert triage, incident investigation, and proactive security improvement.
Key Concepts
Microsoft Defender Threat Analytics
Threat analytics is a Microsoft Defender capability that provides security intelligence about current and emerging threats. It is tied to Microsoft’s threat intelligence research and helps analysts understand what Microsoft is seeing across the threat landscape.
Threat analytics can include information about:
- Ransomware campaigns
- Extortion activity
- Phishing campaigns
- Hands-on-keyboard attacker activity
- Vulnerability exploitation
- Attack campaigns
- Tools and techniques used by threat actors
- CVEs and known vulnerabilities
For an SC-200 analyst, the value of threat analytics is not just reading about threats. The more important value is being able to determine whether those threats are relevant to your own environment.
Where Threat Analytics Fits in Microsoft Defender
In the Microsoft Defender portal, threat analytics is found under the Threat Intelligence area.
A typical navigation path is:
Microsoft Defender portal → Threat Intelligence → Threat analytics
From this area, an analyst can review current threat reports and determine whether any of the threats have been observed in the tenant.
Threat analytics can help answer questions such as:
- Is this threat active in the wild?
- Does this campaign involve email, endpoints, identity, or cloud resources?
- Are there any related incidents in my environment?
- Are any assets impacted?
- Are any endpoints exposed?
- What recommended actions should we take?
- What mitigation or hardening steps does Microsoft recommend?
Threat Reports and Analyst Reports
Threat analytics provides write-ups and analyst reports for specific threats. These reports help explain the threat, how it works, and why it matters.
A report may include:
- A high-level summary of the threat
- Technical details about the attack path
- Related vulnerabilities or CVEs
- Associated attacker techniques
- Related incidents in the tenant
- Impacted assets
- Endpoint exposure information
- Recommended actions
- Diagrams or flow charts explaining the attack chain
From a SOC perspective, these reports can help an analyst quickly understand the behavior of a threat without having to start from scratch.
CVEs and MITRE Relevance
Many threats in threat analytics are associated with CVE identifiers.
CVE stands for Common Vulnerabilities and Exposures. CVEs are standardized identifiers used to track publicly known cybersecurity vulnerabilities.
Example format:
CVE-YYYY-NNNNN
MITRE maintains the CVE program and database. Microsoft Defender threat analytics may reference CVEs when a threat involves exploitation of a known vulnerability.
For SC-200, remember this distinction:
- CVE identifies a known vulnerability.
- MITRE ATT&CK describes attacker tactics, techniques, and procedures.
- Threat analytics uses Microsoft threat intelligence to explain real-world threats, campaigns, and exposure.
Exposure and Impact Information
Threat analytics is especially useful because it connects external threat intelligence to internal tenant context.
For example, a threat report may show whether there are:
- Related incidents
- Impacted assets
- Exposed endpoints
- Recommended remediation actions
This helps an analyst prioritize what matters.
A global threat may be severe, but if the tenant has no exposed assets or related activity, the immediate response may be different than if Defender shows impacted endpoints or active incidents.
Threat Analytics Dashboards
Threat analytics can organize threat information into useful views, such as:
- Latest threats
- High-impact threats
- Highest-exposure threats
- Threats with low, medium, or high exposure levels
These views help SOC teams avoid treating every published threat the same way. Analysts can focus attention on threats that are both significant and relevant to their environment.
Custom Alert Policies in Microsoft Defender
What Custom Alert Policies Do
Custom alert policies allow administrators and security teams to define alert conditions based on specific activities.
In the transcript example, a custom alert policy is created for malware detected in inbound email.
This type of alert policy is useful when an organization wants to be notified when specific activity occurs, such as:
- Malware detected in an email message
- Suspicious email activity
- Unusual activity volume
- Threat-related events
- User or admin activity matching defined conditions
Custom alert policies help convert security-relevant activity into actionable alerts.
Where Custom Alert Policies Are Configured
The navigation path shown in the lesson is:
Microsoft Defender portal → Email & collaboration → Policies & rules → Alert policy
From there, an analyst or administrator can create a new alert policy.
A custom alert policy generally includes:
- Name and description
- Category
- Severity
- Activity condition
- Additional filters or conditions
- Trigger logic
- Notification settings
- Policy status
Alert Policy Categories and Severity
When creating a custom alert policy, you choose a category and assign a severity.
Example category:
- Threat management
Example severity:
- High
Severity matters because it affects how the alert is prioritized during triage. A high-severity alert should generally receive more immediate attention than an informational or low-severity alert.
For SC-200, remember that severity should match the risk and operational urgency of the event.
Activity-Based Alert Conditions
Alert policies are based on activity conditions.
In the lesson example, the selected activity is:
Detected malware in an email message
The example also specifies that the message direction is:
Inbound
This means the alert policy is focused on malware detected in email entering the organization.
Additional conditions can be added to make the alert more specific, such as filtering by sender domain. For example, an organization could create a more targeted policy for messages from a specific domain or external sender pattern.
Alert Trigger Options
A custom alert policy can trigger in different ways.
Common trigger options include:
| Trigger Type | Meaning |
|---|---|
| Every time activity matches | Generate an alert whenever the defined condition occurs |
| Volume-based threshold | Generate an alert only when activity reaches a certain count within a time window |
| Unusual activity volume | Generate an alert when the activity becomes abnormal compared to expected behavior |
The correct trigger depends on the scenario.
For high-risk events such as malware detection, triggering every time may be appropriate. For noisy activity, a volume threshold may reduce alert fatigue.
Notification Settings
Alert policies can send notifications to specific recipients when triggered.
The lesson example includes an email notification recipient and a notification limit. This is important because if an alert triggers repeatedly, unlimited email notifications could overwhelm analysts or mailbox recipients.
Notification limits help prevent a flood of emails during high-volume events.
Built-In Alert Policies
Microsoft Defender includes many built-in alert policies. These are preconfigured policies that detect common types of suspicious or risky activity.
An example mentioned in the lesson is:
- Reply-all storm detected
Built-in policies are useful because organizations do not have to manually create every detection from scratch. However, custom policies are still useful when the organization has specific monitoring requirements.
Alerts in Microsoft Defender
When alert policies trigger, the resulting alerts can be reviewed in Microsoft Defender.
Alerts are security signals that may later contribute to incidents. In Microsoft Defender XDR, alerts can be correlated into incidents when multiple related signals are connected.
For SC-200, remember:
- Alert policy defines the logic that generates an alert.
- Alert is the detection result.
- Incident groups related alerts, entities, and evidence into a broader investigation.
Microsoft Security Operations Context
How Threat Analytics Supports SOC Work
Threat analytics helps SOC analysts move from general awareness to actionable investigation.
A practical SOC workflow may look like this:
- Review current high-impact threats in threat analytics.
- Open the Microsoft analyst report for a relevant threat.
- Check whether the tenant has related incidents.
- Review impacted assets and exposed endpoints.
- Validate whether the threat applies to the environment.
- Follow recommended actions.
- Document findings in the incident or ticketing system.
- Improve detection, hardening, or response processes.
Threat analytics is especially useful for proactive security monitoring. It helps analysts identify what they should be looking for before an incident occurs.
How Custom Alert Policies Support SOC Work
Custom alert policies help SOC teams surface important events that may otherwise be missed or buried in normal activity.
A practical SOC workflow may look like this:
- Identify a security activity that should generate an alert.
- Create a custom alert policy with the correct activity condition.
- Assign an appropriate severity.
- Configure trigger logic to balance visibility and noise.
- Configure notifications for the correct team or mailbox.
- Review triggered alerts in Microsoft Defender.
- Investigate affected entities such as users, mailboxes, messages, devices, or files.
- Escalate if the alert indicates active compromise or widespread impact.
Example SOC Scenario
An organization wants to be notified whenever Microsoft detects malware in inbound email.
A security analyst could create a custom alert policy with the following logic:
| Setting | Example |
|---|---|
| Category | Threat management |
| Severity | High |
| Activity | Malware detected in an email message |
| Direction | Inbound |
| Trigger | Every time activity matches |
| Notification | SOC mailbox or security team |
| Status | Enabled |
This would help the SOC quickly detect and review inbound email malware events.
Exam-Relevant Takeaways
For the SC-200 exam, focus on these points:
- Threat analytics is used to review Microsoft threat intelligence and determine whether current threats affect your tenant.
- Threat analytics can show related incidents, impacted assets, endpoint exposure, and recommended actions.
- Threat analytics is found under Threat Intelligence in Microsoft Defender.
- CVEs are standardized identifiers for known vulnerabilities.
- Custom alert policies are configured under Email & collaboration → Policies & rules → Alert policy.
- Custom alert policies define the activity, severity, trigger condition, and notification behavior.
- Built-in alert policies already exist, but custom policies can be created for organization-specific monitoring.
- Alert policies generate alerts; alerts may be reviewed in Microsoft Defender.
- Use thresholds or unusual activity triggers when you need to reduce alert noise.
- Use “every time activity matches” for events where each occurrence should be reviewed.
- Notification limits are important to prevent alert email flooding.
- Threat analytics is proactive and intelligence-driven; alert policies are detection and notification-driven.
Tool / Feature Decision Guide
| Scenario | Best Microsoft Security Tool or Feature | Why |
|---|---|---|
| You need to review current ransomware, phishing, or vulnerability campaigns | Microsoft Defender Threat Analytics | Provides Microsoft threat intelligence and current threat reports |
| You need to know whether a published threat affected your tenant | Threat Analytics related incidents and impacted assets | Connects threat intelligence to tenant-specific exposure and activity |
| You need Microsoft-recommended remediation steps for a known threat | Threat Analytics recommended actions | Provides guidance to reduce exposure or improve defenses |
| You need to generate an alert when malware is detected in inbound email | Custom alert policy | Allows activity-based alerting for defined conditions |
| You want to be alerted only when an event happens many times within a time window | Volume-based alert trigger | Reduces noise by alerting only when a threshold is met |
| You want to be alerted whenever a high-risk event occurs | Every time activity matches | Best for events where each match should be reviewed |
| You want to avoid hundreds of notification emails from the same policy | Notification limit | Prevents excessive email notifications |
| You want to review alerts created by alert policies | Microsoft Defender alerts | Alerts are where triggered detections are investigated |
| You need preconfigured Microsoft alerting for common scenarios | Built-in alert policies | Microsoft provides default policies for common activity patterns |
| You need organization-specific detection logic | Custom alert policy | Custom policies allow tailored monitoring requirements |
KQL Notes
The lesson does not include KQL. Threat analytics and custom alert policies in this example are configured through the Microsoft Defender portal rather than by writing KQL queries.
For the SC-200 exam, this distinction matters:
| Task | KQL Required? | Tool |
|---|---|---|
| Reviewing Microsoft threat reports | No | Threat analytics |
| Checking related incidents and impacted assets from a threat report | No | Threat analytics |
| Creating the demonstrated malware email alert policy | No | Defender alert policy |
| Performing custom log hunting in Microsoft Sentinel or Defender Advanced Hunting | Yes | KQL |
A simple KQL example is not required for this lesson. The main exam focus here is tool selection and understanding when portal-based Defender features are appropriate.
Common Exam Traps
Confusing Threat Analytics with Advanced Hunting
Threat analytics is not the same as advanced hunting.
- Threat analytics provides Microsoft threat intelligence reports and tenant impact context.
- Advanced hunting uses KQL to search raw or normalized security data.
If the scenario asks you to review Microsoft’s analysis of a current threat and see whether your organization is affected, choose threat analytics.
Confusing Alert Policies with Incidents
An alert policy does not directly equal an incident.
- The policy defines what should be detected.
- The alert is generated when the condition matches.
- An incident may group related alerts and evidence.
For the exam, be careful with questions asking whether you need to create a detection, investigate a detection, or correlate multiple detections.
Choosing a Manual Review When Alerting Is Needed
If the scenario says the SOC needs to be notified when a specific activity happens, a custom alert policy may be the correct answer.
Manual review is not scalable when the requirement is continuous monitoring.
Ignoring Alert Noise
Triggering an alert every time activity matches can create noise. For high-risk events, this may be acceptable. For frequent activity, use thresholds or unusual activity options.
The exam may test whether you understand the operational tradeoff between visibility and alert fatigue.
Forgetting Notification Limits
A notification limit can prevent alert storms. If a policy may trigger frequently, notification limits are important.
This is especially relevant in real SOC operations where email-based notifications can become overwhelming.
Treating Every Published Threat as Tenant-Relevant
A severe global threat does not always mean your tenant is impacted.
Threat analytics helps determine whether there are related incidents, impacted assets, or exposed endpoints in your own environment.
Real-World SOC Analyst Notes
Threat Intelligence Must Become Actionable
Threat intelligence is only useful if it leads to action. A SOC analyst should not simply read threat reports. The analyst should determine whether the threat applies to the environment and whether any action is needed.
Important questions include:
- Are we exposed?
- Do we have affected endpoints?
- Are there related incidents?
- Are there vulnerable systems?
- Is remediation required?
- Should this be escalated to endpoint, identity, cloud, or infrastructure teams?
Alert Policies Should Be Designed Carefully
Custom alert policies are powerful, but they can create unnecessary noise if configured poorly.
Before creating a custom alert policy, consider:
- How often will this condition occur?
- Should every match generate an alert?
- Should the policy use a volume threshold?
- Who should receive notifications?
- What severity is appropriate?
- Is there already a built-in policy for this?
- What should the analyst do when the alert fires?
Good alert design improves SOC efficiency. Poor alert design creates fatigue.
Documentation Matters
When using threat analytics during an investigation, document:
- Threat name or CVE
- Whether the tenant had related incidents
- Impacted users, endpoints, or assets
- Recommended actions reviewed
- Actions taken
- Teams notified
- Remaining risk
- Follow-up work
This is important for incident response, auditability, and handoff between SOC shifts.
Coordinate with the Right Teams
Threat analytics may identify exposure that requires action outside the SOC.
Examples:
- Endpoint exposure may require endpoint engineering.
- Vulnerability remediation may require server or desktop teams.
- Email malware findings may require messaging or Microsoft 365 administrators.
- Identity-related findings may require Entra ID or IAM teams.
A SOC analyst often identifies and validates risk, but remediation may require coordination with other teams.
Be Careful with Tenant-Wide Impact
Alert policies and notifications can affect security operations across the tenant. A high-severity custom policy that fires too often can overwhelm the SOC.
Before enabling a new policy in production, consider testing, change control, and stakeholder communication.
Quick Reference Summary
- Threat analytics is found under Threat Intelligence in Microsoft Defender.
- It provides Microsoft threat intelligence about current threats, campaigns, vulnerabilities, and attacker techniques.
- Threat analytics can show whether threats have related incidents, impacted assets, or endpoint exposure in your tenant.
- CVE means Common Vulnerabilities and Exposures.
- Custom alert policies are configured under Email & collaboration → Policies & rules → Alert policy.
- Alert policies can be based on specific activities, such as malware detected in inbound email.
- Alert severity should match business and security risk.
- Trigger options include every match, volume threshold, and unusual activity.
- Notification limits help prevent alert storms.
- Built-in alert policies already exist, but custom policies allow organization-specific alerting.
- Alert policies generate alerts that analysts review in Microsoft Defender.
- For SC-200, know when to use threat analytics versus custom alert policies versus incident investigation.
Flashcards
Q: What is Microsoft Defender threat analytics used for?
A: It provides Microsoft threat intelligence about current threats and helps determine whether those threats affect your environment.
Q: Where is threat analytics located in Microsoft Defender?
A: Under Threat Intelligence → Threat analytics.
Q: What types of threats can appear in threat analytics?
A: Ransomware, phishing, extortion, vulnerability exploitation, attack campaigns, hands-on-keyboard activity, tools, and techniques.
Q: What does CVE stand for?
A: Common Vulnerabilities and Exposures.
Q: Why are CVEs important in threat analytics?
A: They identify known vulnerabilities that may be associated with active threats or attack campaigns.
Q: What tenant-specific information can threat analytics show?
A: Related incidents, impacted assets, endpoint exposure, and recommended actions.
Q: What is a custom alert policy used for?
A: To generate alerts when specific security-related activity matches defined conditions.
Q: Where are custom alert policies configured in the Defender portal?
A: Under Email & collaboration → Policies & rules → Alert policy.
Q: In the lesson example, what activity was used for the custom alert policy?
A: Malware detected in an inbound email message.
Q: What does the “every time activity matches” trigger option do?
A: It generates an alert whenever the defined activity condition occurs.
Q: When would a volume-based trigger be useful?
A: When you only want an alert after activity reaches a certain threshold within a time window.
Q: Why should notification limits be configured?
A: To prevent excessive email notifications if the alert triggers many times.
Q: What is the difference between an alert policy and an alert?
A: The policy defines the detection logic; the alert is generated when the logic matches.
Q: Why are built-in alert policies useful?
A: They provide preconfigured detection for common security and operational scenarios.
Q: What is a common SOC use for threat analytics?
A: Reviewing current threats, checking tenant exposure, and following recommended mitigation actions.
Practice Questions
Question 1:
A SOC analyst wants to review Microsoft’s latest information about an active ransomware campaign and determine whether any assets in the organization are impacted. Which Microsoft Defender feature should the analyst use?
A. Alert policy
B. Threat analytics
C. Microsoft Sentinel watchlist
D. Microsoft Defender Secure Score
Correct Answer:
B. Threat analytics
Explanation:
Threat analytics provides Microsoft threat intelligence reports and can show tenant-specific context such as related incidents, impacted assets, endpoint exposure, and recommended actions.
Question 2:
You need to create a detection that generates an alert whenever malware is detected in an inbound email message. Where should you configure this in Microsoft Defender?
A. Threat Intelligence → Threat analytics
B. Email & collaboration → Policies & rules → Alert policy
C. Microsoft Sentinel → Workbooks
D. Microsoft Entra ID → Sign-in logs
Correct Answer:
B. Email & collaboration → Policies & rules → Alert policy
Explanation:
Custom alert policies can be created in the Defender portal under Email & collaboration policies and rules. The policy can be configured to alert when a specific activity, such as malware detected in email, occurs.
Question 3:
A custom alert policy may trigger hundreds of times during a widespread email malware campaign. What configuration helps prevent the policy from sending excessive email notifications?
A. Assigning a high severity
B. Adding a CVE identifier
C. Configuring a notification limit
D. Opening threat analytics
Correct Answer:
C. Configuring a notification limit
Explanation:
Notification limits help prevent alert policies from sending too many emails when the same policy triggers repeatedly.
Question 4:
A security team wants to be alerted only when a suspicious activity occurs at least 15 times within 60 minutes. Which alert trigger style best matches this requirement?
A. Every time activity matches
B. Volume-based threshold
C. Threat analytics report
D. Manual incident creation
Correct Answer:
B. Volume-based threshold
Explanation:
A volume-based trigger generates an alert only when the number of matching activities reaches a defined threshold within a specified time window.
Question 5:
Which statement best describes the relationship between alert policies and alerts?
A. Alert policies are created after alerts are investigated.
B. Alert policies define conditions that generate alerts when matched.
C. Alerts are the same thing as threat analytics reports.
D. Alerts only exist in Microsoft Sentinel, not Microsoft Defender.
Correct Answer:
B. Alert policies define conditions that generate alerts when matched.
Explanation:
An alert policy contains the detection and trigger logic. When activity matches the policy, Microsoft Defender can generate an alert for analysts to review.