Blog Post

Microsoft Defender for Endpoint Blog
8 MIN READ

How insights from system attestation and advanced hunting can improve enterprise security

depletionmode's avatar
depletionmode
Icon for Microsoft rankMicrosoft
Nov 06, 2019
At Microsoft, we are committed to putting customers’ security first through a comprehensive security stack delivering protection from chip to the cloud. For example, we continuously innovate endpoint...
Updated Nov 19, 2019
Version 11.0
Advanced hunting
Secured-core
System attestation
depletionmode's avatar
Icon for Microsoft rankMicrosoft
Principal Security Researcher
View Profile
Microsoft Defender for Endpoint Blog

Microsoft Defender for Endpoint disrupts ransomware with industry-leading endpoint security, providing comprehensive protection across all platforms and devices.

When evaluating various solutions, your peers value hearing from people like you who’ve used the product. Review Defender for Endpoint by filling out a Gartner Peer Insights survey and receive a $25 USD gift card (for customers only). Here are the Privacy/Guideline links: Microsoft Privacy Statement, Gartner’s Community Guidelines & Gartner Peer Insights Review Guide.

Rakeshillam's avatar
Rakeshillam
Copper Contributor
Apr 24, 2020

Hi,

Is there any way to create a custom rule using advanced hunting to detect machines which are on inactive state?

 

For example we have some critical resources which have the Microsoft monitoring agent is installed and we need to identify in case if on of these machines are not sending data to ATP for a period of time. So if we can have an advance hunting option to identify this scenario, we can also create a custom rule to alert the Administrator.

 

Thanks in advance