Defender for Cloud Multicloud Posture Triage
Northwind runs 60 Azure subscriptions and 25 AWS accounts. Microsoft Defender for Cloud is enabled. The security team receives 900 active recommendations and 40 high-severity alerts per week. Triage is manual. Two problems dominate: (1) most recommendations are low-value hygiene items that no one owns, and (2) the team cannot tell which alerts represent real attack paths versus misconfiguration noise. The CISO asks whether to enable Defender CSPM and the attack path analysis feature, or to instead buy a third-party CSPM tool. She also wants to know how to reduce alert fatigue without turning off detections. Budget is approved for Defender plans.
1. Recommend whether to adopt Defender CSPM with attack path analysis versus a third-party tool, justifying with the specific problems described.
Read the worked answer
Adopt Defender CSPM with attack path analysis; the described problems map directly onto its capabilities:
- 900 recommendations with no ownership - Defender CSPM provides cloud security explorer and governance/ownership features, and the attack path view prioritizes the small number of recommendations that actually matter to reach a critical asset. Instead of triaging 900 flat recommendations, the team works the finite set of attack paths.
- Can't distinguish real attack paths from noise - attack path analysis builds a graph of internet exposure, permissions, and lateral movement to show concrete multi-step paths to high-value resources. That is exactly the 'is this a real attack path?' question the team cannot answer today.
- Multicloud (Azure + AWS) - Defender CSPM and attack path analysis span connected AWS accounts, so one tool covers both clouds rather than stitching two.
A third-party CSPM could also do posture, but the stated pain is prioritization and attack-path context, which is native here and already licensed-adjacent (budget approved for Defender plans). The judgment: match the tool to the prioritization problem, not just the scanning problem.
2. The team wants less alert fatigue without disabling detections. What Defender for Cloud mechanisms should they use, and what should they explicitly avoid?
Read the worked answer
Use triage and suppression mechanisms that preserve detection:
- Alert suppression rules - suppress specific, known-benign alerts (by alert type and scope) rather than disabling the plan. Suppressed alerts are still recorded for audit.
- Security rules / governance - assign recommendations to owners and set remediation timeframes so hygiene items stop landing on the security team.
- Auto-provisioning and continuous export to route alerts to the SIEM (e.g., Microsoft Sentinel) for correlation, so the team works correlated incidents rather than raw alerts.
- Attack path prioritization to focus on high-severity, exploitable paths first.
- Workflow automation to auto-close or route low-value items.
Explicitly avoid: disabling Defender plans or individual detections to reduce volume (loses coverage and audit trail), and blanket-suppressing by severity rather than by specific known-benign pattern. The exam distinction is suppression/scoping versus disabling - the former keeps the detection, the latter removes it.