With the new Advanced Hunting capability on Windows Defender Advanced Threat Protection, you have even more powerful tools for successfully tracking and identifying advanced persistent threats. To he...
Updated Sep 16, 2020
Version 6.0
Blog Post
AH is evolving in a very positive way. I have some follow up questions:
- Are you looking to offer import capabilities, something along the lines of consumers downloading IOC standard type formats (OpenIOC_1.1, STIX, YARA) that can be converted into a format to be used in AH?
- Would be great to create a query, schedule it to run and have a number of alert notification capabilities e.g. via a dashboard in the portal, email etc. Is this something on your roadmap?
- Any thoughts on the ability to ingest results of queries into a SIEM?
- TomerBrand
Microsoft
Hi Sean,
We have a custom TI interface which you can use to convert your IOC streams into and feed to WDATP. Once done the system will constantly match those against incoming telemetry and raise alert in case of a match (documentation is here)
Regarding the schedule queries and alert on the results - yes this is on our RS5 list. The intent here is to make those standard alerts, which will also be available for pulling over the SIEM interface
Thanks,
Tomer
