Page 136 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
Microsoft distinguishes recursive and iterative DNS queries in the Windows name-resolution process. The documented query process covers the path from a client query through cache, authoritative data, forwarding, or iterative resolution.
Read the checklist
For an IPv4 reverse lookup, the DNS client reverses the address octets and appends the in-addr.arpa suffix to form the query name. The example authoritative response returns a PTR record whose data is the fully qualified domain name associated with the queried address.
Read the explainer
Windows DNS Policy can distribute application traffic according to time of day. Microsoft states that multiple DNS policies are ordered and that the first matching policy is used.
Read the guide
Anycast assigns the same IP address to multiple endpoints and uses routing to select a destination. Microsoft describes Anycast DNS as a way to scale a stateless service and add geographic routing and redundancy.
Read the playbook
Defender for Identity forwards CEF security-alert fields including start, suser, shost, outcome, msg, cnt, app, and externalId to a SIEM. Microsoft recommends identifying alert types with externalId in automation because alert names can change while each alert type’s externalId is permanent.
Read the playbook
A Defender for Identity workspace is automatically created in the data center geographically closest to the Microsoft Entra ID tenant and cannot later be moved; its geolocation appears under Settings → Identity → About. Defender for Identity retains data visible across the portal for 180 days.
Read the guide
Defender for Identity alert learning periods tune detections, and testing without the needed learning period reduces detection accuracy.
Read the playbook
ATA data is not migrated to Defender for Identity, so Microsoft recommends retaining the ATA Data Center and alerts needed for ongoing investigations until those alerts are closed or remediated.
Read the briefing
Metric progress represents exposure improvement on a scale from 0 for high exposure to 100 for no exposure. Metric weight represents relative importance and effect on the initiative score; the interface shows High, Medium, Low, or Risk accepted.
Read the briefing
Alert tuning automatically resolves alerts according to the configured rule conditions, reducing the alerts that require triage. Microsoft recommends checking whether existing tuning rules match as expected and, when a rule has no matches, considering whether it is still needed or can be removed.
Read the explainer