Microsoft Defender for Endpoint

Navigate the rising complexity of cyber security across people, cloud, endpoints, OT, and IoT, while addressing talent shortages, advanced threats, data deluge, and disconnected tools.

Explore the core security operations center activities, including threat intelligence, threat hunting, log management, threat detection, incident response, root cause investigation, and reducing the attack surface.

Explore the three-tier soc model, where automation handles commodity malware, tier one tackles easier tasks, tier two addresses advanced malware, and tier three conducts proactive threat hunting and forensics.

The lecture outlines the NIST incident response process, from preparation and stakeholder alignment to detection, analysis, containment, eradication, recovery, and post-incident lessons.

Explore how EDR and XDR enable behavior-based threat detection across endpoints and beyond, using Defender for Endpoint, Defender for Cloud, and Sentinel with SIEM, SOAR, and Logic Apps.

Blue teams monitor and respond within the SOC, while red teams perform vulnerability assessments, penetration testing, and social engineering; purple teaming unites them to simulate adversary TTPs and strengthen defenses.

Apply the NIST definition to cyber threat intelligence: a threat is any circumstance or event with the potential to adversely impact operations, assets, or individuals through an information system.

Define intelligence and distinguish cyber threat intelligence from general threat intelligence, identifying adversaries, threat actors, and their tactics, techniques, and procedures in cybersecurity contexts.

Define cyber threat intelligence as knowledge about adversaries' motivations, intentions, and methods, collected, analyzed, and disseminated to protect enterprise assets through ttps (tactics, techniques and procedures).

Clarifies threat, vulnerability, and risk by defining threat actors, exploitation of vulnerabilities, and how impacts like downtime, confidentiality breaches, integrity violations, and financial impact along with likelihood create cybersecurity risk.

Explore how threat informed defense leverages cyber threat intelligence to identify threat actors and TTPs. Align your SoC with EDR, XDR, and SIEM to detect and protect against threats.

Explore how tactics, techniques and procedures distinguish high-level threat objectives from concrete actions, and how procedures detail deep sub techniques within the Mitre attack framework.

Differentiate iocs from ioas by focusing on evidence of compromise versus attacker intent and behavior, using iocs like file hashes and domains to detect breaches, and ioas to detect threats.

Use the pyramid of pain to prioritize tactics, techniques, and procedures detection over hashes or domains, as TPS indicators resist attacker changes and strengthen enterprise defenses.

Identify three CTI sources: paid enterprise tools, free osint offerings, and social media insights, with examples like Microsoft Defender Threat Intelligence, VirusTotal, Shodan, and Twitter/X.

Zero trust is a security strategy and mindset, not a product, focusing on explicit verification, just-in-time access, and assuming breach to minimize blast radius.

Inspect the Microsoft security cosmos focused on cloud security, SOC, and CTI, using Defender XDR, Defender for Cloud, Microsoft Sentinel, and Copilot for security to strengthen multi-cloud and on-prem protection.

Analyze a classic cyber kill chain and how Defender for Office, Defender for Endpoint, Defender for Identity, and Defender for Cloud Apps disrupt each stage from phishing to data exfiltration.

Unifies Defender XDR across endpoint, office, identity, cloud apps, and protection in a pane of glass. Integrates Sentinel and Purview, supporting DevOps security, security posture management, and workload protection.

Explore Microsoft Defender for Endpoint (MDE) as an antivirus and EDR platform, covering vulnerability management, attack surface reduction, next generation protection, and automated investigation and response.

Explore the MDG architecture within Defender XDR, as Defender for Endpoint onboard devices—notebooks, mobile devices, and servers—via the agent and view them in the security.microsoft.com portal.

Obtain a Microsoft 365 E5 trial license and assign it to a user to access Defender XDR features via the resources link and email-based license assignment.

Create an all access role for Defender XDR by configuring read and manage permissions across security operations, posture, and settings. Then assign the role to a user and submit.

Create your free Azure subscription by following the link in the resources section, then choose free or pay-as-you-go, provide details, and log in at portal.azure.com to start building.

Identify connectivity requirements for Defender for Endpoint by allowing required URLs, configuring endpoint proxy settings, and disabling TLS inspection to support certificate pinning and access to the XDR tenant.

Follow the onboarding matrix for Defender for Endpoint across Windows, Server, macOS, Linux, and mobile devices, detailing Intune, GPO or Config Manager, AMD binaries, and mobile device manager options.

Demonstrates onboarding a Windows Server 2022 Azure VM to Microsoft Defender for Endpoint using a local onboarding script, then validating the device in Defender XDR.

Explore the device inventory in Defender XD via the assets blade, and learn to filter by category, OS, risk, exposure, and onboarding status, plus device discovery.

Explore how to create and manage endpoint security policies in Defender XDR, including antivirus, EDR, attack surface reduction, and firewall settings across Windows, Mac, and Linux.

Learn attack surface reduction (asr) to proactively protect your organization by reducing endpoint attack surfaces. Explore features like network protection, application control, device control, controlled folder access, and Azure rules.

Explore ASR rules that target specific software behaviors, including blocking obfuscated scripts and office macro win32 API calls, and blocking executable email content, within the broader attack surface reduction feature.

Learn to implement ASR rules in Defender XDR by creating an endpoint security policy for Windows, configuring rules in audit mode, and planning a 90-day transition to blocking.

Explore network protection in Defender for Endpoint, an attack surface reduction pillar, including web threat protection, custom indicators, and web content filtering to block malicious domains and IPs.

Enable network protection in Defender for Endpoint using PowerShell, verify via get mp preference, and observe the block on a malicious site in a test browser.

Application control enforces an allowlist so only trusted executables run, deployable via config manager on Windows 10+ and Windows Server 2019+ in enforcement or audit mode.

Control whether users can install or use peripheral devices—such as USB drives, printers, and Bluetooth—through device control in Defender for Endpoint, within attack surface reduction, with policies and exceptions.

Explore controlled folder access in Defender for Endpoint, protecting data from ransomware by enforcing a trusted apps list and default folders, configurable via Windows Security, Intune, or Config Manager.

Discover how next generation protection in defender for endpoint combines classic antivirus with behavior-based ML, local and cloud analysis, and real-time blocking of threats.

Learn how cloud delivered protection works in Defender for Endpoint by tracing the detection pipeline from client-side checks to cloud analysis, sample submission, sandbox detonation, and big data threat intelligence.

Demonstrates cloud-delivered protection by Defender Antivirus as it detects and blocks a Log4j2 exploit downloaded from exploit DB on a virtual machine, recording a severe trojan in protection history.

Learn how Defender for Endpoint offers three modes: active (default, primary antivirus), passive (threats scanned and reported to Defender XDR but not remediated), and disabled.

Tamper protection in Defender for Endpoint guards critical antivirus and EDR settings from tampering on Windows devices, preventing changes to real-time protection, cloud protection, and exclusions.

Discover how EDR in Defender for Endpoint detects threats in near real time with behavior-based analysis of TTPs, and leverages six months of telemetry in Defender XDR for incident remediation.

Demonstrates managing incidents and alerts in Defender for Endpoint and Defender XDR, linking alerts to incidents, and reviewing the investigation graph, remediation status, and evidences and responses.

Define vulnerabilities as weaknesses in information system security procedures, internal controls, or implementation that a threat source could exploit, including software, humans, hardware, and physical controls, beyond CVEs.

Explore how Common Vulnerabilities and Exposures framework (CVE) assigns IDs and describes vulnerabilities, with CVE-2009-2935 in Chrome as an example of remote code execution and a CVSS score of 10.

Explore how CVSS scores rank vulnerabilities and compare version 2 and version 3. Balance asset criticality with scoring to prioritize remediation, and use the calculator to compare both CVSS versions.

Defender for endpoint enables vulnerability scanning across the full stack—from application and extension vulnerabilities to operating system and hardware vulnerabilities—demonstrated in console demos.

Explore vulnerability management in defender for endpoint by reviewing device security recommendations, CVE and Cvss scoring, and how misconfigurations beyond CVEs are treated as vulnerabilities.

Explore vulnerability management in Defender for Endpoint, including dashboards, meta recommendations for Microsoft Edge, and remediation workflows. Prioritize fixes using severity signals, exposure, and asset inventory.

Scan your subnet with Defender for Endpoint to discover not onboarded devices. Use passive sniffing or active probing with a limited vulnerability scan across laptops, servers, mobile devices, and IoT.

Configure device discovery in Defender for Endpoint by choosing standard active discovery or passive basic listening, monitor discovered devices, and apply exclusions; authenticated scanning will be deprecated in November 2025.