Detection Exclusions: Mark DCSync, Directory Enumeration and Lateral Movement as Expected

Overview

Some accounts do things that look like attacks. Microsoft Entra Connect replicates the directory, so it matches DCSync. A jump host signs in to dozens of computers, so it matches Lateral movement. A vulnerability scanner reads thousands of directory objects, so it matches Directory enumeration.

A detection exclusion tells one rule that one account's activity is expected. You choose the account, the rule, and where the activity may come from.

An exclusion never silences the activity. The matching event still records as a Low alert titled "Expected ...", for example "Expected replication by CORP\MSOL_31f95b30fbf4". The review trail survives, and the alert doesn't page anyone.

[!WARNING] Confirm only accounts you recognize. A directory sync account and an attacker's replicator look alike. Both replicate directory changes from an account that isn't a domain controller.

How an exclusion is matched

An exclusion matches by the account's security identifier plus a scope. It never matches by name.

• A renamed account stays matched, because its security identifier doesn't change.
• A look-alike account with the same name doesn't match, because its security identifier differs.

The scope narrows where the account's activity is trusted:

The same account confirmed with two different scopes is two exclusions.

Prerequisites

• Role: Admin. Other roles don't see the card or the Mark as expected action.
• License: A license that includes ITDR.
• Data: Windows security events flowing in from your domain controllers (see Telemetry Pipeline), and the account in the identity graph. An account the graph doesn't hold has no security identifier and can't be excluded.

Step-by-step

Add an exclusion from the Suggested list

Use this when GraphnAI has already seen a non-domain-controller account replicate directory changes.

1. Open Admin > Telemetry and select the Detection rules tab.
2. Find the Detection exclusions card.
3. Under Suggested, find the account. A Looks like a directory sync account badge marks accounts that resemble a sync tool. The badge is a hint and not proof.
4. Check the sources and last seen time. Select Review.
5. In the Mark ... as expected dialog, choose These source addresses or This directory partition under Trust replication from, then tick the addresses or partitions.
6. Under Why is this expected?, write the reason. For example, "Microsoft Entra Connect on SYNC01." A reason is required, up to 500 characters.
7. Select Mark as expected.

GraphnAI shows "Saved. Activity from the last 24 hours and new activity are checked against it within a minute."

If GraphnAI couldn't find where the account signed in from, the source address option is disabled. You can then trust a partition only.

Add an exclusion from an alert

Use this for activity that raised a DCSync, Directory enumeration or Lateral movement alert.

1. Open the alert from Detection Alerts to show its flyout.
2. Select Mark as expected.
3. Choose the scope and write the reason, as above.
   • DCSync: These source addresses or This directory partition.
   • Directory enumeration: These source addresses or Any source.
   • Lateral movement: Any source only. Use it for administrators and jump hosts whose job is signing in to many computers.
4. Select Mark as expected.

If the button is disabled, the tooltip reads "This account has no security identifier in the graph, so it can't be excluded safely." That happens with older alerts keyed by name and with accounts the graph doesn't hold.

Review what's excluded

The Detection exclusions card opens with a summary: "Domain controllers replicated N times in the last 24 hours from addresses they normally use." While GraphnAI is still learning where a domain controller replicates from, a second line says when checks start.

The table lists each exclusion:

An alert that an exclusion matched shows "Expected: matches an exclusion added by {who} on {date}." in its flyout. The line links back to the card.

Stop excluding an account

1. On the Detection exclusions card, find the row.
2. Select Stop excluding.
3. Confirm in the dialog: "Stop excluding {name}? Its activity will raise alerts again."

The activity raises alerts at the rule's normal severity from then on.

See revoked exclusions

Turn on Show revoked above the table. Revoked rows show "Stopped by {who} on {date}".

Revoking keeps the record. If you confirm the same account and scope again, the exclusion reactivates and the row shows "Stopped by {who} on {date}, added back by {who} on {date}".

Configuration

Detection exclusions have no settings of their own. Each exclusion holds the rule, the account, the scope and your reason.

Limits:

• Up to 32 source addresses or 8 partitions per exclusion.
• A reason of 1 to 500 characters.
• Well-known accounts can't be excluded.

Troubleshooting

Mark as expected is disabled

The account has no security identifier in the graph. Run a sync from Identity Bridge so the account is in the graph, then open the alert again.

The source address option is disabled

GraphnAI found no sign-in from this account, so it can't tell where the activity comes from. Trust a partition instead, or wait until the account signs in and the suggestion refreshes.

The activity still raised a high-severity alert

Check the scope. An exclusion for source addresses doesn't cover activity from another address. Check that the row is active and not revoked, and that the security identifier matches the account that raised the alert.

Couldn't load exclusions

The card shows "Couldn't load exclusions. Try again in a moment." Select Retry. If it persists, check that you're signed in as an Admin.

A new exclusion doesn't show on past alerts

GraphnAI checks the last 24 hours of activity and new activity against it within a minute. Wait a minute, then reload the page.