Question
Your company uses Microsoft Defender for Endpoint.
The company has Microsoft Word documents that contain macros. The documents are used frequently on the devices of the company's accounting team.
You need to hide false positive in the Alerts queue, while maintaining the existing security posture.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. Resolve the alert automatically.
- B. Hide the alert. Correct
- C. Create a suppression rule scoped to any device.
- D. Create a suppression rule scoped to a device group. Correct
- E. Generate the alert. Correct
Explanation
A suppression rule is created from an existing alert, so the alert must first be generated. In the suppression rule you choose to hide the alert (rather than resolve it) so it stays out of the queue, and you scope the rule to the accounting team's device group so that the same macro activity on any other device still raises an alert. Scoping to any device would weaken detection everywhere, and automatically resolving the alert changes alert state instead of simply keeping the false positive out of the queue.
