#Cloudapp status update#
#Cloudapp status series#
#Cloudapp status download#

The alert status still remains as “NewAlert” in Azure ATP, ISG, and new status update is not synced across the solutions.You do the necessary investigation and resolve the alert in MCAS.One of the main challenges with Microsoft security solutions is that alert status is not synced across solutions. Let’s take a closer look at what it brings to the table in terms of alert management in the next chapter. Microsoft 365 Security Center which contains Microsoft Threat Protection aka MTP features (launched in early 2020) is the newest addition to the toolbox. Both Sentinel and Microsoft 365 Threat Protection suite have a rich set of capabilities for investigation and contain a number of data from the user identity, device identity, and network traffic. It could also be replaced by 3rd party SIEM (Splunk, QRadar, etc). Naturally, if Sentinel is in use it triggers the alert, and the investigation starts from there. In the top category are the solutions which, in my opinion, are the best ones to start the investigation. The best synergy advantages come with the integrations between security solutions. The picture below doesn’t cover all possible security solutions and integration scenarios, it rather gives overall understanding which solutions can be used to investigate alerts and suspicious activity in the cloud or on-premises. At the time of writing, supported security providers in ISG are: These providers send processed alerts also to the Intelligent Security Graph (ISG). What are the security providers? Security providers in Microsoft cloud are the solutions that detect threats & anomalies and create alerts (+ incidents) based on the policies and collected data. Setting Up The Scene – The Security Providers Send Security Alerts from Microsoft cloud to 3rd party SIEM.

#Cloudapp status series#

This is the third blog post of the series and earlier ones can be found from securecloud.blog site: Even though there are new capabilities launched to the security solutions that make security analysts’ life easier such as Microsoft Defender ATP automatic investigation and remediation you still need to manage incidents and alerts in the Microsoft 365 security solutions.

We then exported it to a CSV with the Export-CSV.This blog post is all about alert management in M365 security solutions. So what did we do with PowerShell? We retrieved all items using the Get-ChildItem and retrieved the required info. All to make sure that we could do the cutover in just a few hours. We had the proof the files where available, and everybody was happy. So while we had to sync 160.000 files the OneDrive sync client worked its magic. As hitting the file will trigger the OneDrive sync client to make it available for your user. You can also use the reports to try and open the file if it is not downloaded yet. We used it to make sure the file was synced locally. Using Excel or PowerBI you can use that status information for additional checks. The script outputs a CSV file containing the file path and OneDrive sync status. Focusing on validating the OneDrive Sync folder. Luckily you can use PowerShell to determine the status for each file. Having some reporting can thus help you in identifying problems as well. Fourteen levels of nested folders did occur.

And as you can imagine some of the folders where nested quite deep. The Reports focused on providing details on what was downloaded. So we required some reporting during the sync. And that the data consisted of over 160.000 files. The only downside was that the site collection contained around 250 GB of content.

#Cloudapp status download#

Event with selective sync you can just right-click to download everything. The OneDrive Sync client makes it easy to sync your files. We choose to ‘use’ the OneDrive Sync client. And while there are several third-party solutions to migrate data out of your tenant. A decision was made to migrate all content of a single Site Collection out of their tenant. Recently I was working at a customer who was looking to migrate some of their content out of Office 365.