Microsoft Defender for Endpoint in Depth: Take any organization's endpoint security to the next level

Description

A comprehensive guide to building a deeper understanding of the product, its capabilities, and successful implementation Purchase of the print or Kindle book includes a free PDF eBook Key FeaturesUnderstand the history of MDE, its capabilities, and how you can keep your organization secureLearn to implement, operationalize, and troubleshoot MDE from both IT and SecOps perspectivesLeverage useful commands, tips, tricks, and real-world insights shared by industry expertsBook Description With all organizational data and trade secrets being digitized, the threat of data compromise, unauthorized access, and cyberattacks has increased exponentially. Microsoft Defender for Endpoint (MDE) is a market-leading cross-platform endpoint security solution that enables you to prevent, detect, investigate, and respond to threats. MDE helps strengthen the security posture of your organization. This book starts with a history of the product and a primer on its various features. From prevention to attack surface reduction, detection, and response, you'll learn about the features, their applicability, common misconceptions, and caveats. After planning, preparation, deployment, and configuration toward successful implementation, you'll be taken through a day in the life of a security analyst working with the product. You'll uncover common issues, techniques, and tools used for troubleshooting along with answers to some of the most common challenges cybersecurity professionals face. Finally, the book will wrap up with a reference guide with tips and tricks to maintain a strong cybersecurity posture. By the end of the book, you'll have a deep understanding of Microsoft Defender for Endpoint and be well equipped to keep your organization safe from different forms of cyber threats. What you will learnUnderstand the backstory of Microsoft Defender for EndpointDiscover different features, their applicability, and caveatsPrepare and plan a rollout within an organizationExplore tools and methods to successfully operationalize the productImplement continuous operations and improvement to your security postureGet to grips with the day-to-day of SecOps teams operating the productDeal with common issues using various techniques and toolsUncover commonly used commands, tips, and tricksWho this book is for This book is for cybersecurity professionals and incident responders looking to increase their knowledge of MDE and its underlying components while learning to prepare, deploy, and operationalize the product. A basic understanding of general systems management, administration, endpoint security, security baselines, and basic networking is required. Table of ContentsA Brief History of Microsoft Defender for EndpointExploring Next-Generation ProtectionIntroduction to Attack Surface ReductionUnderstanding Endpoint Detection and ResponsePlanning and Preparing for DeploymentConsiderations for Deployment and ConfigurationManaging and Maintaining the Security PostureEstablishing Security OperationsTroubleshooting Common IssuesReference Guide, Tips, and Tricks Cover Title Page Copyright and Credits Contributors Table of Contents Preface Part 1: Unpacking Microsoft Defender for Endpoint Chapter 1: A Brief History of Microsoft Defender for Endpoint It all started in Romania… The early days of antimalware At the Forefront A cloud was born Making sense of it Rapid innovation Expanding coverage Defender everywhere Microsoft Defender experts Milestone 1 – Microsoft Threat Experts Milestone 2 – growing and scaling Milestone 3 – Microsoft Defender Experts Summary Chapter 2: Exploring Next-Generation Protection What is next-generation protection? Breaking down client-side protection Client-side engines RTP Security intelligence Scan types Running modes Exclusions Expanding on cloud-delivered protection Cloud-based engines Automatic sample submissions BAFS Dynamic security intelligence Block levels Tamper protection Web protection Leveraging SmartScreen and Network Protection clients together Device control Reporting Summary Chapter 3: Introduction to Attack Surface Reduction What is attack surface reduction? Examining ASR rules The philosophy behind ASR rules Rule categories and descriptions Operating modes Exclusions Analyzing ASR telemetry using AH Network protection layers and controls Custom indicators Operating modes CFA ransomware mitigations Operating modes Story from the field Exploit protection for advanced mitigations Summary Chapter 4: Understanding Endpoint Detection and Response Clarifying the difference between EDR and XDR Digging into the components of EDR Telemetry components How telemetry is gathered Zeek integration Understanding alerts and incidents How alerts and incidents are generated Alerts overview Incidents overview Reviewing entities and actions Files Other entities Submitting files to Microsoft Action center Exploring enhanced features Threat analytics Advanced hunting Microsoft Defender Experts Summary Part 2: Operationalizing and Integrating the Products Chapter 5: Planning and Preparing for Deployment Architecting a deployment framework Understanding personas Leadership IT admins Security admin Security operations Gathering data and initial planning Defining scope Performing discovery Analyzing the results Planning your deployment Creating buckets Taking a gradual approach Selecting your deployment method Understanding security operations needs Creating a backout plan Some key considerations per feature Adoption order Next-generation protection Attack surface reduction Endpoint detection and response Other platforms Summary Chapter 6: Considerations for Deployment and Configuration Operating system specifics and prerequisites Understanding monitoring agents Supported operating systems Operating system specifics Prerequisites Configuration options for the portal General options Licenses Email notifications Auto remediation Permissions APIs Rules Configuration management Device management Network assessments Selecting your deployment methodology Onboarding packages and installers Group policy Intune Microsoft Defender for Cloud Other deployment methods Configuration management considerations Shell options Group policy Mobile Device Management (Intune) Microsoft Endpoint Configuration Manager Security management for Microsoft Defender for Endpoint Summary Chapter 7: Managing and Maintaining the Security Posture Performing production readiness checks Considerations for connectivity Enabling Defender Antivirus capabilities Attack surface reduction Endpoint detection and response Server-specific settings Staying up to date Windows Linux and macOS Gradual rollout Maintaining security posture through continuous discovery and health monitoring Sensor health and operating system Intune reports ConfigMgr reports Getting started with vulnerability management Dashboard Security recommendations Remediation Inventories Weaknesses Event timeline Summary Part 3: Operations and Troubleshooting Chapter 8: Establishing Security Operations Getting started with security operations Portal familiarization Security operations structure Understanding attacks The Cyber Kill Chain as a framework MITRE ATT&CK™ framework Case study – defining a modern attack Triage and investigation Antimalware detections and remediations Considering alert verbiage Managing incidents Performing initial triage Moving into investigation and analysis Responding to threats Files and processes URLs and IP addresses Device response actions Putting it into practice Threat hunting Go hunt Further investigation and threat hunting Creating custom detection rules Summary Chapter 9: Troubleshooting Common Issues Ensuring the health of the operating system Windows Linux macOS Checking connectivity Connectivity quick checks and common issues Client analyzer Capturing network packets using Netmon Overcoming onboarding issues Troubleshooting onboarding issues MMA versus the new unified agent Custom indicators Web content filtering Resolving policy enablement Checking settings Addressing system performance issues Windows Linux performance macOS performance Navigating exclusion types to resolve conflicting products Submitting a false positive Exclusions versus indicators Understanding your update sources Comparing files Bonus – troubleshooting book recommendations Summary Chapter 10: Reference Guide, Tips, and Tricks Useful commands for use in daily operations PowerShell reference MpCmdRun macOS/Linux Tips and tricks from the experts Online resources Reference tables Processes ASR rules Settings Logs and other useful output Useful logs Summary Index Other Books You May Enjoy