|
- Step 5. Develop and test use cases - Microsoft Defender XDR
The basics of developing and testing use cases when integrating Microsoft Defender XDR into your security operations
- Answer Threat Intelligence questions with Gemini
Gemini provides links to some of the articles that were the sources for the content used in the summary Note: If Gemini responds to a prompt with text written by someone else, the original source is cited in the Referenced Sources section of the Gemini pane
- Create your first use case - Google Cloud
This document defines a *use case* and outlines the requirements to publish one to the Content Hub It provides a comprehensive guide for creating a new use case, from defining the security threat and building the playbook to the final publication Understand use cases A use case is a package of items that together provide a solution, such as: Automating phishing threats Reducing false
- Advanced hunting query best practices in Microsoft Defender XDR . . .
Look in specific columns —Look in a specific column rather than running full text searches across all columns Don't use * to check all columns Case-sensitive for speed —Case-sensitive searches are more specific and generally more performant Names of case-sensitive string operators, such as has_cs and contains_cs, generally end with _cs
- Cases overview | Google Security Operations - Google Cloud
For details, see What's on the Case Wall tab? Alert Overview tab: Lists all alerts linked to the case, including associated events and metadata This tab displays crucial information and events associated with the case The case queue—automatically refreshed every minute—lists all active cases and lets you manually refresh, sort, filter, add, or close cases as needed Playbook automation
- Hunting graph in advanced hunting - Microsoft Defender XDR
Use predefined scenarios in the hunting graph The hunting graph lets you search with predefined scenarios These scenarios are prebuilt advanced hunting queries that help you answer specific and common questions for specific use cases To start hunting with a predefined scenario, on a new hunting graph page, select Search with Predefined scenarios
- Expression Builder use cases | Google Security Operations | Google . . .
This document provides uses cases that detail how to build and implement dynamic expressions within playbook actions across the Google Security Operations platform It focuses on using the Expression Builder to parse, filter, and extract specific data from previous action results—such as list data, entity details, and scan reports—to drive complex automation logic in subsequent playbook
- File analysis with Microsoft Copilot in Microsoft Defender
The file analysis capability of Copilot in Defender reduces the barrier to learning file analysis by immediately delivering reliable and complete file investigation results This capability empowers security analysts from all levels to complete their investigation with a shorter turnaround time
|
|
|