Detecting, investigating, and responding to application threats
At the core of detecting threats with MDCA, we have anomaly detection policies. Anomaly detection policies evaluate and detect threats by evaluating over 30 different indicators of risk. We listed these earlier when we talked about UEBA. It looks at all users' sessions to evaluate whether the behavior deviates from normal behavior. These policies include the following:
- Impossible travel
- Activity from unusual countries
- Malware detection
- Ransomware activity
- Activity from suspicious IP addresses
- Suspicious inbox forwarding
The following screenshot shows the portal where you can filter on different statuses and severity levels for these alert types, as well as the alert counts for each:
Figure 9.14 – MDCA settings and MIP integration
When it comes to investigating applications, MDCA provides many different dashboards for you to use while digging into alerts...
