Microsoft Purview: Insider Risk Management - DS Triage Agent for IRM available in Defender

🚨 The Signal: Microsoft Purview Insider Risk Management (IRM) alerts now show triage summaries directly in Microsoft Defender. This streamlines incident response by providing key insights without leaving Defender, improving detection and response to insider threats.

The Impact

Security teams are affected by improved insider threat detection and response capabilities, reducing the risk of data exfiltration and security policy violations.

• Security Analysts: Faster triage of insider risk alerts.
• Incident Responders: Quicker identification of high-severity insider threats.
• Data Owners: Reduced risk of sensitive data compromise.
• Compliance Officers: Enhanced visibility into potential policy violations.

The Action

1. Verify Insider Risk Management policies are configured in Microsoft Purview: Purview portal > Insider Risk Management > Policies.
2. Ensure appropriate roles are assigned for IRM alert access in Defender: Microsoft 365 Defender portal > Permissions > Roles.
3. Review existing incident response playbooks to incorporate IRM alert summaries in Defender.
4. Communicate new triage capabilities to security operations centre (SOC) personnel.

Domain: Defender · Impact: medium · Workload: Microsoft Purview