New Defender for Identity health alert for missing domain controller network traffic

🚨 The Signal: Defender for Identity now alerts when domain controller network traffic is missing from sensors. This improves visibility into potential blind spots for threat detection, ensuring critical security data is collected.

The Impact

Security teams are affected by new alerts that highlight critical gaps in domain controller monitoring, increasing risk of undetected threats.

• Security teams: Risk of undetected threats due to missing DC traffic.
• Security teams: Increased workload to investigate and resolve sensor health alerts.
• Network administrators: May need to troubleshoot port mirroring or network connectivity issues.

The Action

1. Monitor the 'Sensors health issues' tab in Microsoft Defender XDR for new alerts.
2. Investigate any 'Missing domain controller network traffic' alerts to identify root cause.
3. Verify port mirroring configurations on domain controllers for Defender for Identity sensors.
4. Check packet capture driver status on affected Defender for Identity sensors.
5. Ensure network traffic is correctly routed to Defender for Identity sensors.

Domain: Defender · Impact: medium · Workload: Microsoft Defender