What's changed: Created SC-200 Chapter 1 (Domain 1 first-half: Defender XDR notifications/alert tuning (suppression)/correlation; Defender for Endpoint (advanced features/custom data collection/ASR rules/device groups/permissions/automation levels); AIR (automated investigation and response)/Action center/automatic attack disruption; Sentinel automation rules (declarative triage)/playbooks (Logic Apps, SOAR)).
1.1Defender XDR notifications and alert tuning
Understand configuring Microsoft Defender XDR email notifications (incidents/actions/threat analytics) and alert notifications, and tuning, suppressing, and correlating alerts.
A SOC analyst’s first job is to "deliver the right signal, to the right people, without noise." Microsoft Defender XDR correlates alerts across identity/endpoint/email/SaaS into incidents. This section designs notifications and alert quality.
1.1.1Configuring notifications
Configure email notifications for new incidents, actions taken (e.g., auto-remediation), and threat analytics (threat reports), targeting the right recipients. Scope by severity, device group, and recipient to fit operations. Alert notifications are also tuned—excessive notifications cause "alert fatigue," so focus on high-priority items.
1.1.2Alert tuning, suppression, and correlation
For false positives or known-benign activity, create alert tuning (formerly alert suppression rules) to auto-resolve/suppress matching alerts. Correlation groups related alerts into a single incident, letting you handle the whole attack as one case. Analysts balance "reduce noise without missing real threats" through precise suppression conditions.
Cues: "email new incidents/actions taken/threat reports to the right people" = Defender XDR email notifications. "auto-resolve false positives/known-benign" = alert tuning (suppression). "group related alerts into one case" = correlation → incident. Scope excessive notifications to avoid alert fatigue.
Watch the mix-ups: (1) Email notifications (whom to notify) vs alert tuning (what to suppress) are different settings. (2) Over-broad suppression misses real threats—keep conditions precise. (3) Since correlation forms incidents, respond at the incident level, not per individual alert.
1.1.3Section summary
- Defender XDR email notifications = new incidents/actions taken/threat analytics to recipients; scope by severity/device group
- Alert tuning (suppression) auto-resolves false positives/known-benign; correlation groups alerts into incidents
- Excessive notifications cause alert fatigue—focus on high priority
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. A known-benign activity repeatedly generates alerts, creating SOC noise. What is the best action?
Q2. You want to email the responsible team about new incidents, auto-remediation actions, and threat reports. Which is best?
Q3. Why are multiple related alerts grouped into a single incident?
Q4. What is the most appropriate caution when designing alert suppression rules?
Q5. Which correctly distinguishes email notifications from alert tuning?