Skip to content
eSHARS Operations

Defender Weekly Review

Procedure for the weekly review of Defender for Cloud findings. Run this every Monday (or first business day of the week) to keep remediation on track.

Prerequisites

Steps

1. Check Automation Audit Log

Verify the automation rules ran correctly in the past week.

  1. Navigate to DEVOPS project > Project Settings > Automation > Audit log
  2. Confirm these rules executed without errors:
    • Defender: SLA reminder -- High stale 7d
    • Defender: Overdue escalation -- High+prod 14d
  3. If a rule shows errors, check the error details and refer to the automation troubleshooting guide

2. Review Wave 1 Status

Wave 1 = High severity + production environment. These are the highest-priority items.

Run this JQL (or use the saved filter Defender - Wave 1 (High+Prod)):

project = DEVOPS AND labels = Defender AND labels = defender-high AND labels = env-prod AND status != Done ORDER BY created ASC

For each item:

  • To Do: Is it assigned? If not, assign to an available team member. If assigned but stale, check for blockers.
  • In Progress: Has the assignee posted an update in the last 7 days? If not, reach out.
  • Blocked: Is there a blocker comment? Create a dependency ticket if needed.

3. Check Overdue Items

Run this JQL (or use the saved filter Defender - Overdue (30d+)):

project = DEVOPS AND labels = Defender AND status != Done AND created <= -30d ORDER BY created ASC

Items flagged by automation Rule 4 will have the overdue label. For each overdue item:

  • Check if escalation comment was posted by automation
  • Determine if the item is truly blocked or just not prioritized
  • Discuss escalation path with team lead if needed

4. Review Dashboard

Open the Defender Security Posture dashboard:

  • Severity breakdown: Are we reducing High items? Is the pie shifting toward Medium/Low?
  • Created vs Resolved: Are we closing more than we’re opening? If not, we’re falling behind.
  • Wave 1 count: Is it going down? Target is zero.
  • Overdue list: Any new items appearing?

5. Verify Recent Closures

Run this JQL (or use the saved filter Defender - Recently Resolved):

project = DEVOPS AND labels = Defender AND status = Done AND resolved >= -7d ORDER BY resolved DESC

For 2-3 recently resolved items, spot-check:

  1. Open the Jira issue and check the Development panel for linked PRs/commits
  2. Verify in Azure Defender portal that the recommendation now shows as “Healthy” for the affected resources
  3. Confirm release notes have been written (see security/release-notes/)

If a resolved Jira ticket still shows as “Unhealthy” in Defender, reopen the ticket and investigate.

6. Update Register (if needed)

If any items were closed, moved between Epics, or re-categorized during the week:

  1. Update security/defender-register.md with the changes
  2. Commit to the develop branch

Outputs

  • Updated Jira board state (assignments, status changes)
  • Any escalations communicated to team lead
  • Register updated in repo (if changes occurred)
  • Notes for sprint planning (new items to include, blockers to discuss)

Time Estimate

15-30 minutes for a typical week. Longer during monthly intake or if there are many overdue items.