New and updated events in the Advanced hunting IdentityDirectoryEvents table
Analysis / inference: Microsoft Defender for Identity added new Active Directory event types and schema details to the Advanced hunting IdentityDirectoryEvents table.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new archive · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft Defender for Identity expanded the IdentityDirectoryEvents table in Advanced Hunting to include events for User Account control flag changes, security group creation, failed password change attempts, successful password changes, and primary group ID modifications.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisSOC analysts rely on advanced hunting tables for identity threat detection, and these new directory event types expand hunting coverage for AD modifications and credential changes.
Enhances visibility into Active Directory modifications and credential alterations, improving threat hunting fidelity in Microsoft Defender XDR.
Section 03 · Recommended actions
- Review the updated Microsoft Defender XDR Advanced Hunting schema documentation.
- Update custom hunting queries to include the newly available ActionType values.
- Verify if existing hunting queries or custom detections for Active Directory changes need to incorporate the new ActionType values in IdentityDirectoryEvents.