Merge pull request #877 from millenniumfalcone/lefalcon/secopsv3

Lefalcon/secopsv3

Author: tylchan

src/react/docs/workshop-guidance/securityoperations/SVA_MDA023.md

@@ -0,0 +1,22 @@
+# Review Microsoft Defender for Cloud Apps Incidents for Suspicious Activity
+
+**Implementation Effort:** Low — This is a targeted administrative task focused on reviewing and investigating alerts in the Defender for Cloud Apps portal, with no broader program or deployment required.  
+**User Impact:** Low — Only administrators perform the investigation steps; non-privileged users are not required to take action.
+
+## Overview
+Microsoft Defender for Cloud Apps helps security teams detect threats by generating alerts and incidents related to suspicious or risky behavior in cloud applications. These incidents may include anomalous sign-ins, impossible travel events, unusual data downloads, or behaviors that match Defender’s machine‑learning–based anomaly detection. Regular review of these incidents helps identify compromised accounts, malicious applications, or risky activities before they escalate. If this activity is not performed, threats may go unnoticed, allowing attackers to persist, exfiltrate data, or expand access across cloud resources.
+
+This activity supports the Zero Trust principle **Assume Breach**, because it relies on continuous monitoring and analytics to detect malicious activity and reduce potential impact.
+
+### Where to Review and Investigate Incidents
+You can review suspicious activity and alerts in:
+1. **Microsoft Defender Portal** → *Cloud Apps* → **Alerts** or **Incidents**  
+   (The investigation workflow for alerts is described in Microsoft's guidance.) 
+2. Use the **anomaly detection investigation guides**, which outline how to inspect unusual behaviors flagged by Defender for Cloud Apps. 
+3. During analysis, apply **activity filters** to refine user, session, and app‑related evidence.
+
+*Note: The Learn articles do not provide extractable images through tool output, so no image is available to embed.*
+
+## Reference
+- (https://learn.microsoft.com/en-us/defender-cloud-apps/investigate)  
+- (https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-anomaly-alerts)  

src/react/docs/workshop-guidance/securityoperations/SVA_MDA024.md

@@ -0,0 +1,17 @@
+# Review Conditional Access App Control Alerts Along With the Activity Log (Daily)
+
+**Implementation Effort:** Low — This is a targeted daily task for administrators to review alerts and activity logs, requiring no major deployment effort.  
+**User Impact:** Low — Only administrators perform these reviews; end users are not notified or required to take action.
+
+## Overview
+Conditional Access App Control (CAAC) in Microsoft Defender for Cloud Apps provides real‑time visibility and control over user sessions to detect risky or suspicious actions. Reviewing CAAC alerts and the activity log daily helps identify unusual behaviors, policy violations, and potential threats early. Microsoft recommends reviewing these alerts and filtering the activity log by source, access control, and session control to quickly locate relevant events. If this activity is not done, suspicious actions may go unnoticed, increasing the risk of data exposure or account compromise.  
+This activity supports the Zero Trust principle **Assume Breach**, as it uses continuous monitoring and analytics to detect and respond to threats.  
+
+### Where to Review in the Product
+You can perform this daily review in:  
+- **Microsoft Defender Portal → Cloud Apps → Alerts**  
+- **Microsoft Defender Portal → Cloud Apps → Activity Log**  
+  (Daily operational guidance recommends focusing on CAAC alerts and filtering the activity logs for more effective review.) 
+
+## Reference
+- [Daily Operational Guide: Reviewing Conditional Access App Control Alerts](https://learn.microsoft.com/en-us/defender-cloud-apps/ops-guide/ops-guide-daily#review-conditional-access-app-control)

src/react/docs/workshop-guidance/securityoperations/SVA_MDA025.md

@@ -0,0 +1,19 @@
+# Review the App Governance Overview Page and Create or Adjust App Governance Policies (Daily)
+
+**Implementation Effort:** Low — This is a targeted daily action where administrators review insights and adjust app governance policies as needed.  
+**User Impact:** Low — Only administrators perform these tasks; non‑privileged users are not required to take action.
+
+## Overview
+App governance in Microsoft Defender for Cloud Apps helps organizations monitor OAuth-enabled applications, assess their permissions, and detect anomalous or risky behaviors. The *App governance overview* page provides a daily snapshot of app posture, highlighting over‑privileged apps, unusual activity, unverified publishers, and other risks. Administrators should review this view daily and create or adjust app governance policies to mitigate emerging risks. If this task is not performed, risky or malicious apps may go unnoticed, exposing sensitive data or increasing the chances of account compromise.  
+This activity supports the Zero Trust principle **Assume Breach**, because app governance uses continuous analytics to identify anomalies and reduce threat impact.
+
+### Where to Review and Configure
+In the Microsoft Defender portal:  
+- **Cloud Apps → App Governance → Overview** for daily posture review  
+- **Cloud Apps → App Governance → Policies** to create or adjust governance policies  
+(Daily operational activities are outlined in the Defender for Cloud Apps operational guide.) [1](https://learn.microsoft.com/en-us/defender-cloud-apps/ops-guide/ops-guide-daily)
+
+## Reference
+- [Daily operational guide – Microsoft Defender for Cloud Apps](https://learn.microsoft.com/en-us/defender-cloud-apps/ops-guide/ops-guide-daily#check-app-governance-overview-page)
+- [Get started with app governance policies](https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-app-policies-get-started)
+- [Create app governance policies](https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-app-policies-create)

src/react/docs/workshop-guidance/securityoperations/SVA_MDA026.md

@@ -0,0 +1,28 @@
+# Review Cloud App Policies and Make Any Necessary Updates (Monthly)
+
+**Implementation Effort:** Low — This is a recurring administrative task where IT/SecOps reviews existing cloud app policies and adjusts them as needed.  
+**User Impact:** Low — All activity occurs within administrative teams; end users do not need to be notified or take action.
+
+## Overview
+Cloud app policies in Microsoft Defender for Cloud Apps help organizations control how cloud applications are accessed, governed, and monitored. Policies can identify risky behavior, enforce information protection, manage OAuth app permissions, and detect threats across sanctioned and unsanctioned cloud services. Reviewing these policies monthly ensures they stay aligned with organizational requirements, emerging threats, and changes in cloud app usage.  
+If this review is not performed, outdated or misaligned policies may fail to block risky apps, detect malicious behavior, or enforce compliance, increasing exposure to data leakage or cloud-based attacks.  
+This activity supports the **Verify Explicitly** Zero Trust principle by ensuring continuous monitoring and validation of cloud application behavior and configurations.
+
+### Where to view and manage policies
+You can review and update cloud app policies in the Microsoft Defender portal:
+
+- **Microsoft Defender portal → Cloud Apps → Policies**  
+  Provides access to policy templates, custom policy creation, and policy configuration.  
+  [Control cloud apps with policies](https://learn.microsoft.com/en-us/defender-cloud-apps/control-cloud-apps-with-policies)  
+- **Cloud Apps → App Governance → App Policies**  
+  Used to manage OAuth app policies for Microsoft 365, Google Workspace, Salesforce, and more.  
+  [Manage app policies](https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-app-policies-manage)  
+- **Monthly Operations Guide**  
+  Microsoft recommends reviewing cloud app policies as part of monthly operational activities.  
+  [Monthly operational guide](https://learn.microsoft.com/en-us/defender-cloud-apps/ops-guide/ops-guide-monthly)
+
+
+## Reference
+- [Control cloud apps with policies](https://learn.microsoft.com/en-us/defender-cloud-apps/control-cloud-apps-with-policies)  
+- [Manage app governance policies](https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-app-policies-manage)  
+- [Monthly operational guide](https://learn.microsoft.com/en-us/defender-cloud-apps/ops-guide/ops-guide-monthly)

src/react/docs/workshop-guidance/securityoperations/SVA_MDE021.md

@@ -1,11 +1,31 @@
-# Configure automated investigation and remediation capabilities
+# Review & Action Auto Investigation & Remediation Recommendations (Defender for Endpoint)
 
-**Implementation Effort:** Medium: Customer IT and Security Operations teams need to drive projects to set up device groups and configure automation levels.
-
-**User Impact:** Low: Action can be taken by administrators, users don’t have to be notified.
+**Implementation Effort:** **Medium** – IT and SecOps teams must configure automation levels and establish workflows to review and approve remediation actions based on automated investigations.  
+**User Impact:** **Low** – All work occurs in the security operations workflow; end users are not prompted to act or notified.
 
 ## Overview
-Automated Investigation and Remediation (AIR) capabilities in Microsoft Defender for Endpoint help security operations teams by mimicking the steps a security analyst would take to investigate and remediate threats. These capabilities can be configured to automatically remediate threats or require approval from the security team, fitting into the Zero Trust framework by ensuring continuous monitoring and response to potential security incidents.
+Microsoft Defender for Endpoint Automated Investigation and Remediation (AIR) helps security teams quickly investigate alerts and automatically take actions such as quarantining files, stopping malicious services, or deleting scheduled tasks. Automated investigations produce remediation recommendations that security analysts can review, approve, or reject. This reduces manual work and speeds up containment. Not enabling or reviewing AIR actions increases attacker dwell time and slows incident response, exposing the environment to higher risk.
+
+AIR supports the Zero Trust principle **Assume Breach** by continuously analyzing device activity, triggering automated investigations, and enforcing remediation actions that limit lateral movement.
+
+### Where to enable/configure
+You can configure AIR automation levels and review remediation actions in the Microsoft Defender portal.
+
+- **Configure automation levels:** Settings → Endpoints → General → Automated investigation & remediation  
+  [1](https://learn.microsoft.com/en-us/defender-endpoint/configure-automated-investigations-remediation)
+
+- **Review/approve remediation actions:** Microsoft Defender → Action center  
+  [2](https://learn.microsoft.com/en-us/defender-endpoint/auto-investigation-action-center)
+
+- **View investigation results:** Incidents & alerts → Automated investigation details  
+  [3](https://learn.microsoft.com/en-us/defender-endpoint/autoir-investigation-results)
+
+*(No images were available in the Learn articles returned by search.)*
 
 ## Reference
-[Configure automated investigation and remediation capabilities](https://learn.microsoft.com/en-us/defender-endpoint/configure-automated-investigations-remediation)
+- https://learn.microsoft.com/en-us/defender-endpoint/configure-automated-investigations-remediation
+- https://learn.microsoft.com/en-us/defender-endpoint/automated-investigations
+- https://learn.microsoft.com/en-us/defender-endpoint/manage-auto-investigation 
+- https://learn.microsoft.com/en-us/defender-endpoint/auto-investigation-action-center 
+- https://learn.microsoft.com/en-us/defender-endpoint/automation-levels 
+- https://learn.microsoft.com/en-us/defender-endpoint/autoir-investigation-results

src/react/docs/workshop-guidance/securityoperations/SVA_MDE023.md

@@ -1,11 +1,24 @@
-# Resolve open incidents on devices
+# Investigate Incident Details & Remediate as Necessary (Daily)
 
-**Implementation Effort:** Medium: Customer IT and Security Operations teams need to drive projects to investigate and resolve incidents using Microsoft Defender for Endpoint.
-
-**User Impact:** Medium: A subset of non-privileged users, such as IT staff and security analysts, may need to take action or be notified of changes.
+**Implementation Effort:** Medium — Security operations teams must perform daily review and triage of incidents, which requires ongoing analyst time but no major implementation projects.  
+**User Impact:** Low — All work happens within security teams; end users do not need to take action or be notified of changes.
 
 ## Overview
-Microsoft Defender for Endpoint provides tools to investigate incidents affecting your network, understand their implications, and collate evidence to resolve them. This capability is crucial for maintaining a Zero Trust framework by ensuring that all incidents are thoroughly analyzed and remediated to prevent security breaches.
+Daily investigation of incidents in Microsoft Defender for Endpoint gives security analysts a complete understanding of ongoing threats by correlating alerts, devices, users, evidence, and automated investigation results into a single incident. Defender automatically investigates supported events and suspicious entities, helping analysts quickly identify impacted assets, suspicious processes, and malicious files. Reviewing incidents daily reduces attacker dwell time and enables fast remediation steps such as isolating devices or approving automated remediation actions. If this review is not done regularly, threats may persist longer, increasing the chances of data exposure, lateral movement, or system disruption.
+
+This supports the Zero Trust **Assume Breach** principle by ensuring constant monitoring, rapid response, and thorough investigation to limit the blast radius of any intrusion.
+
+### Where to investigate and remediate
+You can view and investigate incidents in the following areas of the Microsoft Defender portal:
+
+- **Incidents & alerts → Incidents** — provides correlated alerts, assets, investigations, and evidence from across your environment.  
+  [Investigate incidents in Microsoft Defender XDR](https://learn.microsoft.com/en-us/defender-xdr/investigate-incidents)  
+- **Incident details page** — shows alerts, affected devices, user accounts, mailboxes, and automated investigation results.  
+  [View the details and results of an automated investigation](https://learn.microsoft.com/en-us/defender-endpoint/autoir-investigation-results)  
+- **Automated investigations** — includes information about suspicious entities and remediation actions automatically performed or awaiting approval.  
+  [Investigate incidents in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/investigate-incidents)
 
 ## Reference
-[Investigate incidents in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/investigate-incidents)
+- [Investigate incidents in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/investigate-incidents)  
+- [Investigate incidents in Microsoft Defender XDR](https://learn.microsoft.com/en-us/defender-xdr/investigate-incidents)  
+- [View the details and results of an automated investigation](https://learn.microsoft.com/en-us/defender-endpoint/autoir-investigation-results)

src/react/docs/workshop-guidance/securityoperations/SVA_MDE025.md

@@ -1,11 +1,25 @@
-# Follow security recommendations to improve Endpoint Security initiative score
+# Prioritize Actions to Improve Your Endpoint Security Posture Based on Risk and Impact
 
-**Implementation Effort:** Medium: Customer IT and Security Operations teams need to drive projects to review and implement security initiatives and recommendations.
-
-**User Impact:** Medium: A subset of non-privileged users may need to take action or be notified of changes, depending on the specific security recommendations applied.
+**Implementation Effort:** Medium — Security and IT teams must drive ongoing review and improvement projects using prioritized recommendations from Defender for Endpoint and Microsoft Security Exposure Management, but these do not require broad operational restructuring.  
+**User Impact:** Low — Actions are taken by administrators; end users generally do not need to make changes or be notified.
 
 ## Overview
-Microsoft Security Exposure Management provides a metric-driven approach to track and improve security posture through initiatives. These initiatives include detailed insights, target scores, and associated security recommendations, helping organizations to manage and remediate security risks effectively.
+This capability focuses on helping security teams understand which endpoint security issues pose the highest risk and which actions will have the greatest impact on reducing exposure. Microsoft Defender for Endpoint provides prioritized improvement actions through tools such as Secure Score, while **Microsoft Security Exposure Management (MSEM)** adds deeper context by identifying critical assets, attack paths, misconfigurations, exposed secrets, and vulnerabilities. MSEM surfaces a **prioritized list of remediation actions**, enabling teams to focus their limited resources where they will reduce the most risk.  
+If this activity is not done, organizations may apply effort to low‑impact tasks, leaving high-risk gaps open and increasing the likelihood of successful attacks.
+
+This aligns with the **Assume Breach** Zero Trust principle by using analytics and continuous assessment to reduce exposure, strengthen defenses, and limit potential attacker impact.
+
+### Where to prioritize and take action
+- **Microsoft Defender portal → Secure Score → Improvement Actions**  
+  Helps identify recommended actions to strengthen endpoint security posture.  
+  *[Assess your security posture with Microsoft Secure Score](https://learn.microsoft.com/en-us/defender-xdr/microsoft-secure-score-improvement-actions)* 
+- **Microsoft Security Exposure Management → Security Recommendations**  
+  Provides a prioritized list of actions that address vulnerabilities, misconfigurations, and exposed secrets.  
+  *[Review security recommendations in Microsoft Security Exposure Management](https://learn.microsoft.com/en-us/security-exposure-management/security-recommendations)* 
+
 
 ## Reference
-[Review security initiatives in Microsoft Security Exposure Management](https://learn.microsoft.com/en-us/security-exposure-management/initiatives)
+- [Microsoft Security Exposure Management — Strategy Overview](https://learn.microsoft.com/en-us/unified-secops/overview-msem-strategy) 
+- [Security Recommendations in MSEM](https://learn.microsoft.com/en-us/security-exposure-management/security-recommendations) 
+- [Exposure Insights in MSEM](https://learn.microsoft.com/en-us/security-exposure-management/exposure-insights-overview) 
+- [Microsoft Secure Score Improvement Actions](https://learn.microsoft.com/en-us/defender-xdr/microsoft-secure-score-improvement-actions)