Defender for Identity alerts transitioned to the unified Defender alerting experience
Analysis / inference: Several classic Microsoft Defender for Identity security alerts have been migrated to the unified Microsoft Defender alerting format with new detector IDs.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new archive · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Specific legacy Defender for Identity alerts—including LDAP reconnaissance, SMB enumeration, account enumeration, LDAP brute-force, and EFSRPC network connection alerts—were migrated to the unified XDR alert schema with updated external IDs and detector names.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisClassic Microsoft Defender for Identity alerts have been converted to the unified Microsoft Defender alerting schema and external IDs, shifting SOC incident triage workflows and SIEM query mappings.
Analyst triage queues and hunting queries referencing old Defender for Identity classic alert titles or numeric IDs may require updates to align with the new unified XDR naming convention.
Section 03 · Recommended actions
- Review automated playbooks and alert processing logic for the affected Defender for Identity external IDs.
- Update internal documentation and detection engineering references to map old IDs to the new unified detector IDs.
- Verify if existing SIEM forwarding rules or automated response playbooks depend on the legacy Defender for Identity alert IDs (2210, 2012, 2003, 2004, 2416).
- Check Microsoft Defender XDR incident queues for the newly named unified alert entries such as xdr_LdapSensitiveAttributeReconnaissance and xdr_SmbSessionEnumeration.