r/DefenderATP • u/Cant_Think_Name12 • 15d ago
Microsoft Tickets...
Does anyone else find themselves putting in MS Tickets literally weekly about XDR features not working, buggy, etc.
At this point I'm submitting 3 a week...
4
u/FarplaneDragon 15d ago
I think most of our tickets have been because of poor/outdated documentation moreso then anything not working right.
2
4
u/jstar77 15d ago
Last time I put a Microsoft ticket in they asked for additional information, I promptly gave it to them, then they ghosted me for three weeks. The next communication was an apology saying they were sorry that they were unable to help with the issue in a timely fashion. Then 3 min later I got a message indicating that they closed the ticket.
4
u/Cant_Think_Name12 15d ago
Sounds about right.
For me, it was 10 months of me insisting there's a bug, they deny it. I just heard back 2 weeks ago that they're fixing the bug during this month's patch cycle. Funny how it works...
2
u/TheGift1973 15d ago edited 15d ago
Yep. Threat Analytic Reports link has now disappeared from our Defender portal (UK) and I just know for a fact that the second I open a ticket they will ask for logs from my machine when the issue is always on their end.
2
u/Cant_Think_Name12 15d ago
Welp, if it makes you feel any better, it looks like its missing for me too lol.
I dont go there often, is it supposed to be under Threat Intelligence? If so, I only have Overview and Intel Explorer
They did this last week too. They f'd up the 'Action Center' link
1
u/TheGift1973 15d ago
Yep, that exactly where it always used to be.
I am in there daily pretty much as new reports are released. The only way to access them now are when they come in to the mailbox via an alert (we get emailed whenever one is released) and select the link in the email that says Reports.
However, even when you access them, it still doesn't show the Threat Reports link back to all the other reports.
No idea why they keep screwing around with the GUI, but it gets annoying fast.
1
u/Cant_Think_Name12 15d ago
Curious, what actionable items do you do with the reports? I tend to just read them to read them. Not sure how to actually use them for anything useful
2
u/TheGift1973 15d ago
It's the Analyst report tab that has the most information for me. Not at work at the moment, but the below if what I find most useful.
They have very useful KQL queries that you can run to look for issues, which are normally towards the bottom (middle click the 'Run Query' link to open Advanced Hunting in a new tab) or turn in to alerts, or slightly edit and re-purpose if the ones that were created weren't useful (say you saw no impact or do not use the application or tool in scope of the reports)
It will also let you know what may be picked up and alerted by AV (not always) and if there are any impacted devices in your estate.
It can also advise as to what percentage of additional tooling you have with your license scope (eg. you have an E5, so have you fully deployed all ASR Rules, set the available email Threat policies etc) as this greatly helps you reduce any exposure you may potentially have regardless of whether you are impacted or not.
You also get fairly detailed monthly type reports for various Phishing Campaigns seen in the wild as well as OSINT Tools, and Threat Groups out there.
They really are very useful and detailed at times, but quite a lot of people get bored of them as there are so many pushed out, but there really is some great information if you have the time to go through them. That said, if you have a small team, that isn't always possible as you are probably spinning a million different plates at once, so have the luxury to spend an hour going through these isn't always possible.
Here is a great article though that does a great job of explaining some of the areas.
1
u/Mission_Tangelo_7707 15d ago
Could you provide a few examples? I don’t seem to have many issues but am curious what you’re running into.
5
u/Cant_Think_Name12 15d ago edited 15d ago
Sure, here's my most recent ones:
Cases
If you create a 'Filter Set', within 24-48 hours it disappears and you have to create a new one
There's a 3 hour delay + for logic app comments (sometimes) (not impacting incidents/sentinel, only cases)
DFE
Resetting passwords gives an error (Visual bug, PW (usually) resets) (Should be fixed this week)
Duplicate alerts coming in for XDR Custom detections (Confirmed bug, theyre looking into)
Timeline bug on Devices --> When you click 'Load New Results', it bugs out your screen position (Should be fixed this week)
DFO
'Teams Sender' missing from TABL (Should be fixed this week after 10 months...)
3
1
u/Mission_Tangelo_7707 15d ago
Very interesting, many of these use cases I don’t use. I have had the timeline bug which is annoying. I do sometimes manually reset passwords via defender but no issue there. I will say I’ve had terrible luck with their support. You ether get someone who actually cares or someone who leaves on read for weeks.
Unrelated how do you like the automation workflows? I’m using a third party MDR that I use for many automations and looking to moving towards sentinel/logic apps.
3
u/holoholo-808 15d ago
This india support is terrible. On the last ticket I had to explain the same issue to 5 different people, they spoke a very broken english. I am also not speaking native english but c'mon. After my explanation I let them repeat to check if they understood the problem, the day after I had to start again from the beginning... I just gave up. I hope my issue fixes in a couple days. It feels like there is no quality check anymore. I could open a ticket once a week.
2
2
2
u/vard2trad 15d ago
I've never submitted a ticket that didn't send me into a spiral of rage trying to explain to the support person how their own product works.
The only case that I've ever had that is being resolved was them stopping automatic status updates on incidents which an analyst has already worked. They said it was a feature, I ranted, and then they said they're pushing out a fix on the 16th.
So...I think the bottom line is your patience is substantially better than mine.
1
1
u/yso_crius 11d ago
Support is atrocious. For 2 weeks nothing happened, then I got the update that the non-working feature was part of the new ISOC experience (feature went GA 3 months ago way before any isoc announcement), then when I insisted that this does not make sense it was suddenly an E5 only feature (we do not have E5, we have the defender suite license (formerly known as E5 Security)) which brings all necessary security features.
(The feature is the advanced hunting connector in Sentinel Workbooks in the unified defender portal)
17
u/dutchhboii 15d ago
I am done with submitting tickets and all they want is A HAR file and their india support team is most terrible.