Blog Post

Microsoft Defender for Endpoint Blog
6 MIN READ

New network-based detections and improved device discovery using Zeek

eladsolomon's avatar
eladsolomon
Former Employee
Nov 28, 2022
Organizations are finding network-based attacks becoming an increasingly popular way of infiltrating systems because they often leave minimal traces on source and target devices. At Microsoft Ignite ...
Updated Apr 14, 2023
Version 2.0
microsoft defender for endpoint
Zeek
eladsolomon's avatar
Former Employee
Joined November 22, 2022
View Profile
Microsoft Defender for Endpoint Blog

Microsoft Defender for Endpoint disrupts ransomware with industry-leading endpoint security, providing comprehensive protection across all platforms and devices.

When evaluating various solutions, your peers value hearing from people like you who’ve used the product. Review Defender for Endpoint by filling out a Gartner Peer Insights survey and receive a $25 USD gift card (for customers only). Here are the Privacy/Guideline links: Microsoft Privacy Statement, Gartner’s Community Guidelines & Gartner Peer Insights Review Guide.

pshef's avatar
pshef
Copper Contributor
Nov 29, 2022

Similar to what philost said, it would be great if we could query an actual zeek database, maybe make Advanced Hunting or Sentinel queries using zeek-cut or something along those lines. Are there any plans to make zeek data available for 3rd party use? (e.g. so we can use a 3rd party software that would use zeek data) That way we wouldn't need to install zeek twice, once for Defender once for something else.