Microsoft Defender XDR

Navigate the complexity of modern cybersecurity across people, cloud, endpoints, mobile, ICS/OT, and IoT, while addressing talent gaps and automation needs with Microsoft Defender XDR.

Define the security operations center and explain its core activities, including threat intelligence, threat hunting, log management, threat detection, incident response, and root cause investigation, and reduce the attack surface.

Most SOCs use a three-tier SOC: automation handles commodity malware, tier one handles routine alerts, tier two addresses advanced threats, and tier three performs proactive threat hunting and forensics.

Align with stakeholders to prepare incident processes, setting clear roles and measurement criteria. Detect and analyze incidents to triage severity, assign responders, contain, eradicate, recover, and implement post-incident lessons learned.

Demystify EDR, XDR, SIEM, and SOAR by showing how they monitor behavior, centralize logs, and automate incident response across the Microsoft Defender and Sentinel ecosystem.

blue team handles security monitoring, incident response, and forensics in the soc. red team conducts vulnerability assessments, penetration testing, social engineering; purple teaming unites blue and red to strengthen security.

Define cyber threats using the NIST definition: circumstance or event that can harm operations, assets, or individuals through information system, including unauthorized access, destruction, disclosure, modification, or denial of service.

Clarify the differences between intelligence, threat intelligence, and cyber threat intelligence (CTI). Explain that intelligence is broad and may be non-cyber, while CTI focuses on adversaries and their cyber TTPs.

Define cyber threat intelligence as knowledge about adversaries' motivations, intentions, and methods, per the Center for Internet Security, including tactics, techniques, and procedures, gathered to enable threat-informed defense.

Define and distinguish threat, vulnerability, and risk, explaining how threat actors initiate threats, exploit vulnerabilities, and cause impact, with risk as the combination of impact and likelihood.

Explore threat informed defense by answering mission, target actors, motivations, and ttps, then sharpen detection and protection using cyber threat intelligence.

Explore tactics, techniques, and procedures (TTPs) in cyber threat intelligence, from high-level threat actor objectives to detailed procedures that explain how techniques are realized.

Differentiate iocs and ioas by defining indicators of compromise as breach evidence and indicators of attack as threat actor behavior and intent, with examples like file hashes and domains.

The pyramid of pain shows how hard it is for attackers to change indicators from hashes, ip addresses to domains and tools, so detecting tactics, techniques, and procedures come first.

Identify three CTI sources: enterprise paid tools like Microsoft Defender Threat Intelligence, open source osint such as VirusTotal and Shodan, and social media for IOCs and threat actor insights.

Define vulnerabilities as weaknesses in an information system that threat sources could exploit. Include people, physical security, and hardware, note misconfigurations also count, and not all vulnerabilities have CVEs.

Explore the common vulnerabilities and exposures framework and CVE IDs, as defined by Mitre, including descriptions, data sources, vendor announcements, and CVE-2009-2935 in Google Chrome with a 10 CVSS score.

See how CVSS scores rank vulnerabilities and how CVE IDs link to them, guiding remediation. Compare CVSS version two and version three, and account for asset criticality in prioritization.

Cloud computing rests on five properties: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service, explaining why we use cloud for fast provisioning and billing.

Examine public, private, multicloud, and hybrid cloud models with Azure, AWS, and GCP; learn how Azure Stack, AWS Outposts, and Google Anthos enable hybrid and multicloud deployments.

Explore the Azure global backbone, detailing data centers, regions, fiber networks, subsea cables, edge sites, and peering connections to deliver high performance, fault tolerance, and disaster recovery.

Explore the shared responsibility model in Azure across on premises, IaaS, PaaS, and SaaS. See how responsibilities shift between customers and providers and how security duties vary by service.

Explore the Azure resource hierarchy from management groups to subscriptions and resource groups, and learn how grouping resources by lifecycle supports governance, security, and cost management.

Explore Azure subscription types, including free and student subscriptions, pay as you go, and enterprise agreements. Learn which are most suitable for demos and enterprise use.

Explore how Entra ID tenants relate to Azure subscriptions and resource groups, clarify that subscriptions are not tenants, and show how identities access resources within the identity provider ecosystem.

Adopt zero trust as a strategy and mindset that verifies explicitly across identity, device health, and data classification, enforces least-privilege with just-in-time access, and assumes breach to minimize blast radius.

Explore the Microsoft security cosmos, focusing on cloud security, SOC, and CTI, and see how Defender XDR and its components secure multi-cloud and on-prem resources.

Navigate a kill chain and see how Microsoft Defender XDR coordinates Defender for Office, Defender for Endpoint, Defender for Identity, Sentinel, and Copilot for security to stop breaches.

Discover how prompts drive interactions with large language models, using natural language questions, structured commands, or programming contexts, and apply prompt engineering to add context for cyber threat intelligence results.

Train AI models on diverse data sources to form a foundation model, then adapt for use-case specific tasks like analysis, questions and answers, or object recognition in cybersecurity.

Explore the architecture of large language models in LMS, from user prompts through application services and plugins to databases and websites, and assess OWASP top ten threats across LLM layers.

Explore OWASp and its top ten security risks for web apps, APIs, and large language models, plus open source tools like OWASp Zap and the Web Security Testing Guide.

Explore the OWASP Top 10 for large language models, including prompt injection, insecure output handling, training data poisoning, denial of service, and model theft.

Discover how adversaries use generative ai to fuel misinformation, personalized phishing at scale, and impersonation, while enabling exploit research and evasion techniques that democratize cybercrime.

Explores how Microsoft defines responsible artificial intelligence, emphasizing fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability.

Understand Microsoft’s AI shared responsibility model across infrastructure, platform, and software offerings, clarify customer duties for training, governance, and usage policies, and avoid assuming Microsoft handles everything.

Learn the MITRE ATT&CK framework, a DHS-funded nonprofit that maps adversary tactics, techniques, and procedures to enable threat-informed defense against known attacks; see its use with Microsoft Sentinel.

Map the pyramid of pain to MITRE ATT&CK, aligning tactics, techniques and sub techniques, while noting that hash values, IP addresses and domain names are not the focus.

Explore the three matrices—enterprise, mobile, ICS—and their submatrices for Windows, Linux, Mac OS; iOS and Android; cloud services like Azure AD/Entra ID, O365, Google Workspaces; networks and containers.

Explore the Mitre framework's tactics, their high-level objectives, and the 14 enterprise tactics—from reconnaissance and resource development to initial access, persistence, lateral movement, data collection, exfiltration, and impact.

Explore how techniques translate tactics within the middle attack framework, highlighting reconnaissance, active scanning, initial access, persistence, defense evasion, discovery, and exfiltration through C2 channels.

Explore how sub techniques detail attacker methods with concrete examples like vulnerability scanning, spear phishing, DLL injection, and RDP across tactics such as reconnaissance and execution.

Explore tactics, techniques, sub-techniques within the attack framework and learn why adversaries act, how they achieve objectives, and how to leverage these insights with examples like execution and Python.

Identify the right data sources to collect telemetry and detect adversaries, using the MITRE framework to map reconnaissance, active scanning, and vulnerability scanning to network traffic and logs.

Detect attacker techniques and sub techniques, such as reconnaissance and vulnerability scanning, by analyzing network traffic and web application firewall logs, and implement CIM-based alerts for scans.

Apply mitigations through preventative configurations to reduce the attack surface, minimize data exposed to external parties, and establish privileged account management for privilege escalation risks in Active Directory.

Learn how threat groups are defined by related behavior and tracked by vendor-specific names across three major vendors, such as apt 41, fancy bear, and midnight blizzard, highlighting cross-vendor differences.

Examine software as adversarial tools and malware, understand how it links to techniques, groups, and campaigns, and recognize built-in, public, or commercially available software like PowerShell.

Describe campaigns as orchestrated intrusion operations over time with shared targets and objectives, not isolated breaches; illustrate with Sandworm's Ukraine electric power grid attack and the Maccabees espionage campaign.

Define how groups, tactics, objectives, motivations, techniques, and sub techniques interrelate to form campaigns. Learn how data sources enable detections to reveal adversary activity and how Mimikatz supports techniques.

Navigate the MITRE attack matrix for enterprise in a live browser view, exploring tactics, techniques, subtechniques, mitigations, detections, and CTI insights for practical threat detection.

Explore how the ATT&CK framework evolves through semiannual updates that add techniques and sub-techniques, reflecting intelligence community observations, while rarely introducing new tactics.

Learn how to obtain an E5 trial license for free and assign it to a user to access Defender XDR features, via the portal and licenses page.

learn how to create a free Azure subscription, compare free and pay as you go options, provide personal details, then log in to portal.azure.com to start building in Azure.

Install VirtualBox to host Kali Linux, download from resources, select Windows as the OS, run the installer with default settings, view the overview, then proceed.

Install Kali Linux in VirtualBox to set up a security testing environment, including downloading, extracting the VM image, configuring RAM and CPU, and launching the virtual machine.

Configure the Kali Linux keyboard layout by opening the settings manager from the Kali icon, adding your language (German) and English (US), adjusting priority with arrows, and removing unused keyboards.

Install the Tor browser on Kali via apt, then launch the Tor browser launcher and verify its signature. Prepare to connect to Tor for testing various defender services.

Discover Defender XDR, a unified extended detection and response portal for incident response, integrating Defender for Endpoint, Defender for Identity, Defender for Office, and Defender for Cloud Apps.

Learn to manage alerts and incidents in defender XDR, view attack stories, investigate alerts, and assign SOC personnel while classifying incidents as true or false positives.