QuestionQ110Verified/Threat Hunting and InvestigationCopy linkReport a problemAsk AstroTutorSave questionWhich of the following is NOT an event monitored for a Honeytoken account?AEmail address was changed on a Honeytoken accountBA Honeytoken account was createdCLogon Activity from a Honeytoken accountDPassword reset on a Honeytoken accountShow AnswerAnswerExplanationMicrosoft Defender for Identity monitors authentication activity and attribute modifications for preconfigured honeytoken users. Email-address changes and password resets are attribute modifications, while logon activity is authentication activity. Creating an account is not an activity on an already preconfigured honeytoken account.Learn moreMicrosoft Defender for Identity classic alertsShow comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion