Prepare for SC-200 with a reference that remembers your progress.

Defender for Cloud turns workload telemetry into prioritized alerts and correlated incidents. Effective response validates the signal, contains the threat, remediates affected resources, and reduces recurrence.

Detections use global threat intelligence, behavioral analytics, and anomaly detection. Alerts have high, medium, low, or informational severity and can map to MITRE ATT&CK tactics. Cloud Smart Alert Correlation groups related alerts into an incident, representing a broader attack story.

The alert page provides affected resources, entities such as IPs, files, users, and processes, investigation context, and a Take action area.

Use Take action to mitigate the current threat, prevent similar attacks, trigger a Logic App, or create a suppression rule. Workflow automation can invoke Logic Apps automatically when alerts or recommendations match configured conditions such as subscription, resource type, alert name, or severity.

1. Validate and scope the alert.
2. Contain affected identities, resources, or network paths.
3. Remove persistence and remediate configuration weaknesses.
4. Restore safely and monitor for recurrence.
5. Automate repeatable, well-tested actions.

Use suppression only for a validated false-positive or known benign pattern. Rules can match attributes such as IP, process, user, resource, or location and can expire after a defined period, up to six months in the lesson. Simulate the rule before activation.

The underlying alert is still generated but is automatically dismissed. Keep scope narrow, document ownership and rationale, and review rules before expiration.

Threat intelligence reports provide context beyond one alert. Report types include Activity Group, Campaign, and Threat Summary. They can describe the actor, objectives, campaigns, tactics, techniques and procedures, indicators of compromise, victimology, and recommended defenses.

Resource-specific response combines alert context with native logs. For a Key Vault alert, validate the user or service principal, source IP, operation, and targeted object; revoke or rotate exposed credentials; restrict network access; inspect Activity and diagnostic logs; and apply the associated security recommendations.

Use the same pattern for other resources: validate actor and action, contain identity/network/resource, preserve evidence, remediate the exploited weakness, and monitor.

Review alert versus incident, severity and MITRE mapping, Take action options, workflow automation, suppression simulation and expiration, threat-intelligence reports, and resource-native investigation.

Triage with context, correlate the full incident, contain quickly, remediate root causes, automate deterministic actions, and suppress only well-understood benign patterns.