{"id":10616,"date":"2025-03-25T07:01:04","date_gmt":"2025-03-24T22:01:04","guid":{"rendered":"https:\/\/m365jp.net\/?p=10616"},"modified":"2025-03-25T07:15:27","modified_gmt":"2025-03-24T22:15:27","slug":"mc992217-updated-microsoft-defender-changes-to-defender-for-cloud-apps-alerts-2","status":"publish","type":"post","link":"https:\/\/m365jp.net\/index.php\/2025-03-25-mc992217-updated-microsoft-defender-changes-to-defender-for-cloud-apps-alerts-2","title":{"rendered":"MC992217 | (Updated) Microsoft Defender: Changes to Defender for Cloud Apps alerts"},"content":{"rendered":"<div class=\"postie-post\">\n<div>\n<hr>\n<table id=\"section\">\n<tbody>\n<tr>\n<th width=\"95%\">MC992217 | (Updated) Microsoft Defender: Changes to Defender for Cloud Apps alerts<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<table id=\"data\">\n<tbody>\n<tr>\n<th>Classification<\/th>\n<td>planForChange<\/td>\n<\/tr>\n<tr>\n<th>Last Updated<\/th>\n<td>03\/24\/2025 21:28:00<\/td>\n<\/tr>\n<tr>\n<th>Start Time<\/th>\n<td>01\/30\/2025 00:33:10<\/td>\n<\/tr>\n<tr>\n<th>End Time<\/th>\n<td>05\/28\/2027 07:00:00<\/td>\n<\/tr>\n<tr>\n<th>Message Content<\/th>\n<td>\n<p>Updated March 24, 2025: We have updated the rollout timeline below. Thank you for your patience.  <\/p>\n<p>Coming soon for Microsoft Defender for Cloud Apps:<\/p>\n<ul>\n<li>A change to alerts generated by events originating from Defender for Cloud Apps that are generated in the Microsoft Defender XDR detection engine<\/li>\n<\/ul>\n<p>This rollout aims to provide more accurate and precise information on the origin of these alerts, enabling customers to identify, manage, and respond to alerts more effectively.    <\/p>\n<p>[When this will happen:]  <\/p>\n<p>General Availability (GCC, GCC High, DoD, Production, DoD): We will begin rolling out early March 2025 and expect to complete by late May 2025 (previously early April).  <\/p>\n<p>[How this will affect your organization:]  <\/p>\n<p>We will change the field indicating the alert source in the alert data itself.<b> Note:  <\/b>The rollout will only affect new alerts generated after the rollout and will not alter existing alerts.  <\/p>\n<p>This rollout will be reflected in all experiences where alerts are represented, including  <i>Incidents &amp; alerts<\/i> queues in the XDR portal, <i>Advanced hunting<\/i>, and the correlating APIs and SIEM systems.  <\/p>\n<p>In the Defender XDR portal, the change will be reflected in the Service sources field, replacing the current Microsoft Defender XDR values with the new value Defender for Cloud Apps. The detection sources will remain unchanged and will continue to indicate   the detections are generated in the XDR detection engine.<\/p>\n<p>The alert ID prepended characters of some of the alerts will also be changed to comply with the Defender XDR mapping.  <\/p>\n<p>Learn more about the different alert sources in Defender XDR in the <i>Alert sources<\/i> section of  <a href=\"https:\/\/learn.microsoft.com\/defender-xdr\/investigate-alerts?tabs=settings#alert-sources\" target=\"_blank\" style=\"background-color: rgb(255, 255, 255); font-family: sans-serif; font-weight: 400;\">  Investigate alerts in Microsoft Defender XDR &#8211; Microsoft Defender XDR | Microsoft Learn<\/a><\/p>\n<p>In the Microsoft Graph API, Microsoft Defender for Endpoint streaming API, and the Microsoft Azure Events Hub, the change will be reflected in the alert resource type under the property  <code>serviceSource<\/code>, and the previous values of <code>microsoft365Defender<\/code>&nbsp;will change to  <code>microsoftDefenderForCloudApps<\/code>.  <\/p>\n<p>Learn more about the Graph API alert resource: <a href=\"https:\/\/learn.microsoft.com\/graph\/api\/resources\/security-alert?view=graph-rest-1.0\" target=\"_blank\">  alert resource type &#8211; Microsoft Graph v1.0 | Microsoft Learn<\/a>  <\/p>\n<p>Learn more about Streaming API: <a href=\"https:\/\/learn.microsoft.com\/defender-xdr\/streaming-api\" target=\"_blank\">  Stream Microsoft Defender XDR events &#8211; Microsoft Defender XDR | Microsoft Learn<\/a>  <\/p>\n<p>[What you need to do to prepare:]  <\/p>\n<p>This rollout will happen automatically by the specified date with no admin action required before the rollout.  <\/p>\n<p>Administrators should review and update any custom alert rules, playbooks, or automations involving the alerts mentioned above (Service sources = Microsoft Defender XDR and Detection sources = Defender XDR, to ensure they reflect the new value. You may also   want to notify your users about this change and update any relevant documentation.  <\/p>\n<p>As a reminder, detection sources will remain unchanged, so if you only filter on detection sources, everything should continue to function as normal.<\/p>\n<\/td>\n<\/tr>\n<tr>\n<th>Machine Translation<\/th>\n<td>\n<p>2025 \u5e74 3 \u6708 24 \u65e5\u66f4\u65b0: \u4ee5\u4e0b\u306e\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8 \u30bf\u30a4\u30e0\u30e9\u30a4\u30f3\u3092\u66f4\u65b0\u3057\u307e\u3057\u305f\u3002\u3054\u7406\u89e3\u3044\u305f\u3060\u304d\u3042\u308a\u304c\u3068\u3046\u3054\u3056\u3044\u307e\u3059\u3002<\/p>\n<p>Microsoft Defender for Cloud Apps \u306e\u8fd1\u65e5\u516c\u958b\u4e88\u5b9a:<\/p>\n<ul>\n<li>Microsoft Defender XDR \u691c\u51fa\u30a8\u30f3\u30b8\u30f3\u3067\u751f\u6210\u3055\u308c\u308b Defender for Cloud Apps \u304b\u3089\u767a\u751f\u3057\u305f\u30a4\u30d9\u30f3\u30c8\u306b\u3088\u3063\u3066\u751f\u6210\u3055\u308c\u308b\u30a2\u30e9\u30fc\u30c8\u306e\u5909\u66f4<\/li>\n<\/ul>\n<p>\u3053\u306e\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u306f\u3001\u3053\u308c\u3089\u306e\u30a2\u30e9\u30fc\u30c8\u306e\u767a\u751f\u5143\u306b\u95a2\u3059\u308b\u3088\u308a\u6b63\u78ba\u3067\u7cbe\u5bc6\u306a\u60c5\u5831\u3092\u63d0\u4f9b\u3057\u3001\u304a\u5ba2\u69d8\u304c\u30a2\u30e9\u30fc\u30c8\u3092\u3088\u308a\u52b9\u679c\u7684\u306b\u7279\u5b9a\u3001\u7ba1\u7406\u3001\u5bfe\u5fdc\u3067\u304d\u308b\u3088\u3046\u306b\u3059\u308b\u3053\u3068\u3092\u76ee\u7684\u3068\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>[\u3053\u308c\u304c\u3044\u3064\u8d77\u3053\u308b\u304b:]<\/p>\n<p>\u4e00\u822c\u63d0\u4f9b (GCC\u3001GCC High\u3001DoD\u3001Production\u3001DoD): 2025 \u5e74 3 \u6708\u4e0a\u65ec\u306b\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u3092\u958b\u59cb\u3057\u30012025 \u5e74 5 \u6708\u4e0b\u65ec (\u4ee5\u524d\u306f 4 \u6708\u4e0a\u65ec) \u307e\u3067\u306b\u5b8c\u4e86\u3059\u308b\u4e88\u5b9a\u3067\u3059\u3002<\/p>\n<p>[\u3053\u308c\u304c\u3042\u306a\u305f\u306e\u7d44\u7e54\u306b\u3069\u306e\u3088\u3046\u306b\u5f71\u97ff\u3057\u307e\u3059\u304b:]<\/p>\n<p>\u30a2\u30e9\u30fc\u30c8\u30c7\u30fc\u30bf\u81ea\u4f53\u306e\u30a2\u30e9\u30fc\u30c8\u30bd\u30fc\u30b9\u3092\u793a\u3059\u30d5\u30a3\u30fc\u30eb\u30c9\u3092\u5909\u66f4\u3057\u307e\u3059\u3002<b> \u624b\u8a18\uff1a <\/b>\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u306f\u3001\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u5f8c\u306b\u751f\u6210\u3055\u308c\u305f\u65b0\u3057\u3044\u30a2\u30e9\u30fc\u30c8\u306b\u306e\u307f\u5f71\u97ff\u3057\u3001\u65e2\u5b58\u306e\u30a2\u30e9\u30fc\u30c8\u306f\u5909\u66f4\u3055\u308c\u307e\u305b\u3093\u3002<\/p>\n<p>\u3053\u306e\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u306f\u3001XDR \u30dd\u30fc\u30bf\u30eb\u306e <i>\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u3068\u30a2\u30e9\u30fc\u30c8<\/i> \u30ad\u30e5\u30fc\u3001 <i>\u9ad8\u5ea6\u306a\u30cf\u30f3\u30c6\u30a3\u30f3\u30b0<\/i>\u3001\u95a2\u9023\u3059\u308b API \u3068 SIEM \u30b7\u30b9\u30c6\u30e0\u306a\u3069\u3001\u30a2\u30e9\u30fc\u30c8\u304c\u8868\u793a\u3055\u308c\u308b\u3059\u3079\u3066\u306e\u30a8\u30af\u30b9\u30da\u30ea\u30a8\u30f3\u30b9\u306b\u53cd\u6620\u3055\u308c\u307e\u3059\u3002<\/p>\n<p>Defender XDR \u30dd\u30fc\u30bf\u30eb\u3067\u306f\u3001\u5909\u66f4\u304c [\u30b5\u30fc\u30d3\u30b9 \u30bd\u30fc\u30b9] \u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u53cd\u6620\u3055\u308c\u3001\u73fe\u5728\u306e Microsoft Defender XDR \u5024\u304c\u65b0\u3057\u3044\u5024 Defender for Cloud Apps \u306b\u7f6e\u304d\u63db\u3048\u3089\u308c\u307e\u3059\u3002\u691c\u51fa\u30bd\u30fc\u30b9\u306f\u5909\u66f4\u3055\u308c\u305a\u3001\u691c\u51fa\u304c XDR \u691c\u51fa\u30a8\u30f3\u30b8\u30f3\u3067\u751f\u6210\u3055\u308c\u305f\u3053\u3068\u3092\u5f15\u304d\u7d9a\u304d\u793a\u3057\u307e\u3059\u3002<\/p>\n<p>\u4e00\u90e8\u306e\u30a2\u30e9\u30fc\u30c8\u306e\u30a2\u30e9\u30fc\u30c8 ID \u306e\u5148\u982d\u306b\u4ed8\u52a0\u3055\u308c\u305f\u6587\u5b57\u3082\u3001Defender XDR \u30de\u30c3\u30d4\u30f3\u30b0\u306b\u6e96\u62e0\u3059\u308b\u3088\u3046\u306b\u5909\u66f4\u3055\u308c\u307e\u3059\u3002<\/p>\n<p>Defender XDR \u306e\u3055\u307e\u3056\u307e\u306a\u30a2\u30e9\u30fc\u30c8 \u30bd\u30fc\u30b9\u306e\u8a73\u7d30\u306b\u3064\u3044\u3066\u306f\u3001\u300cMicrosoft Defender XDR \u3067\u30a2\u30e9\u30fc\u30c8\u3092\u8abf\u67fb\u3059\u308b\u300d\u306e\u300c <i>\u30a2\u30e9\u30fc\u30c8 \u30bd\u30fc\u30b9<\/i> \u300d\u30bb\u30af\u30b7\u30e7\u30f3\u3092\u53c2\u7167\u3057\u3066\u304f\u3060\u3055\u3044  <a href=\"https:\/\/learn.microsoft.com\/defender-xdr\/investigate-alerts?tabs=settings#alert-sources\" target=\"_blank\" style=\"background-color: rgb(255, 255, 255); font-family: sans-serif; font-weight: 400;\">  &#8211; Microsoft Defender XDR |\u30de\u30a4\u30af\u30ed\u30bd\u30d5\u30c8 \u30e9\u30fc\u30f3<\/a><\/p>\n<p>Microsoft Graph API\u3001Microsoft Defender for Endpoint \u30b9\u30c8\u30ea\u30fc\u30df\u30f3\u30b0 API\u3001Microsoft Azure \u30a4\u30d9\u30f3\u30c8 \u30cf\u30d6\u3067\u306f\u3001\u5909\u66f4\u306f\u30d7\u30ed\u30d1\u30c6\u30a3  <code>serviceSource<\/code> \u306e\u4e0b\u306e\u30a2\u30e9\u30fc\u30c8 \u30ea\u30bd\u30fc\u30b9\u306e\u7a2e\u985e\u306b\u53cd\u6620\u3055\u308c\u3001\u4ee5\u524d\u306e <code>microsoft365Defender<\/code>&nbsp;\u306e\u5024\u306f  <code>microsoftDefenderForCloudApps<\/code> \u306b\u5909\u66f4\u3055\u308c\u307e\u3059\u3002<\/p>\n<p>Graph API \u30a2\u30e9\u30fc\u30c8 \u30ea\u30bd\u30fc\u30b9\u306e\u8a73\u7d30: <a href=\"https:\/\/learn.microsoft.com\/graph\/api\/resources\/security-alert?view=graph-rest-1.0\" target=\"_blank\">  \u30a2\u30e9\u30fc\u30c8 \u30ea\u30bd\u30fc\u30b9\u306e\u7a2e\u985e &#8211; Microsoft Graph v1.0 |\u30de\u30a4\u30af\u30ed\u30bd\u30d5\u30c8 \u30e9\u30fc\u30f3<\/a>  <\/p>\n<p>\u30b9\u30c8\u30ea\u30fc\u30df\u30f3\u30b0 API: <a href=\"https:\/\/learn.microsoft.com\/defender-xdr\/streaming-api\" target=\"_blank\">  Microsoft Defender XDR \u30a4\u30d9\u30f3\u30c8\u306e\u30b9\u30c8\u30ea\u30fc\u30df\u30f3\u30b0 &#8211; Microsoft Defender XDR |\u30de\u30a4\u30af\u30ed\u30bd\u30d5\u30c8 \u30e9\u30fc\u30f3<\/a>  <\/p>\n<p>\u3010\u6e96\u5099\u306b\u5fc5\u8981\u306a\u3053\u3068\u3011<\/p>\n<p>\u3053\u306e\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u306f\u3001\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u524d\u306b\u7ba1\u7406\u8005\u306e\u64cd\u4f5c\u3092\u5fc5\u8981\u3068\u305b\u305a\u306b\u3001\u6307\u5b9a\u3055\u308c\u305f\u65e5\u4ed8\u307e\u3067\u306b\u81ea\u52d5\u7684\u306b\u884c\u308f\u308c\u307e\u3059\u3002<\/p>\n<p>\u7ba1\u7406\u8005\u306f\u3001\u4e0a\u8a18\u306e\u30a2\u30e9\u30fc\u30c8 (\u30b5\u30fc\u30d3\u30b9 \u30bd\u30fc\u30b9 = Microsoft Defender XDR \u3068\u691c\u51fa\u30bd\u30fc\u30b9 = Defender XDR) \u306b\u95a2\u9023\u3059\u308b\u30ab\u30b9\u30bf\u30e0 \u30a2\u30e9\u30fc\u30c8 \u30eb\u30fc\u30eb\u3001\u30d7\u30ec\u30a4\u30d6\u30c3\u30af\u3001\u307e\u305f\u306f\u81ea\u52d5\u5316\u3092\u78ba\u8a8d\u3057\u3066\u66f4\u65b0\u3057\u3001\u65b0\u3057\u3044\u5024\u304c\u53cd\u6620\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u307e\u305f\u3001\u3053\u306e\u5909\u66f4\u306b\u3064\u3044\u3066\u30e6\u30fc\u30b6\u30fc\u306b\u901a\u77e5\u3057\u3001\u95a2\u9023\u3059\u308b\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u66f4\u65b0\u3059\u308b\u3053\u3068\u3082\u3067\u304d\u307e\u3059\u3002<\/p>\n<p>\u306a\u304a\u3001\u691c\u51fa\u30bd\u30fc\u30b9\u306f\u5909\u66f4\u3055\u308c\u306a\u3044\u305f\u3081\u3001\u691c\u51fa\u30bd\u30fc\u30b9\u306e\u307f\u3092\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3059\u308b\u5834\u5408\u3067\u3082\u3001\u3059\u3079\u3066\u304c\u901a\u5e38\u3069\u304a\u308a\u6a5f\u80fd\u3057\u307e\u3059\u3002<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>MC992217 | (Updated) Microsoft Defender: Changes to Defender for Cloud Apps alerts Classification planForChang [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-10616","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/10616","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/comments?post=10616"}],"version-history":[{"count":0,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/10616\/revisions"}],"wp:attachment":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/media?parent=10616"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/categories?post=10616"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/tags?post=10616"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}