tag: False-Positive · 2 items
- Engineer — Plan: If your org uses Defender for Office 365, check whether Safe Links is blocking legitimate Google URLs and configure allow-list exceptions or monitor Microsoft’s investigation for a fix.
- SOC/IR — Plan: Expect a spike in user-reported blocked links; tune alert triage to deprioritize Safe Links hits on google.com domains until Microsoft issues a resolution.
- Leader — Skip
- Engineer — Learn: Defender Antivirus false-positive after recent update may trigger compliance alerts or monitoring noise; no patch or configuration change needed, just awareness that the UI error is benign until Microsoft releases a fix.
- SOC/IR — Act: Suppress or contextually tune alerts for Defender ‘antivirus turned off’ events caused by this update so analysts aren’t flooded with false positives; document the known-issue window to avoid masking real AV-disabling activity.
- Leader — Skip