Forum Widgets
Latest Discussions
Missing auditability on use of Explorer and Advanced Hunting
Considering Defender for Office's Explorer and Advanced Hunting can be used to get insight into very sensitive data we assumed this activity is auditable, but unfortunately not. A Microsoft Support request confirmed it's not, and we're confused as to why and would highly request Microsoft to implement audit tracking for any user, including queries used. Explorer gives access to email subjects and Advanced Hunting can be used to view users files etc so from a GDPR and tracking point of view we need to be able to audit our SOC team and other admins on when they access potential personal information.Pal Espen BruFeb 14, 2025Copper Contributor5Views0likes0CommentsHow to Get the Most Out of MDVM Webinar - Q&A Overflow
This page is to address the questions that we did not have time to get to in our latest webinar: How to Get the Most Out of Microsoft Defender for Vulnerability Management (MDVM) on February 12, 2025. We will be posting answers to all questions that were submitted, so make sure to bookmark this page and check it regularly over the next week or so as we continue to update this space with answers. Thanks for your participation in our call! Check out the recording of this call here: https://youtu.be/dQL9CRKzVa816Views0likes0CommentsDefender Deception Advance Lures - verification
Hello everyone, I'm looking to deploy defender deception in our environment. I've successfully tested and verified the basic lures, but I'm having trouble with the advanced lures/decoys. Specifically, I can't find a way to verify the account-planted cached credentials. Initially, I thought dumping LSASS would show some reference, but I found nothing. Has anyone tried this, and what were the results? Additionally, from an attacker's perspective, how would these account decoys be discovered? Thank you in advance.11Views0likes0CommentsData at rest Europe
Why in the world would MDE and XDR default ro Europe when our entire cloud services host oir of eastus? Data at rest shows Europe instead of eastus which is oue default tenant. Also the fact that XDR setup failed to ask set region is biggest bug in this stack along with MDE. what would have caused these two to get setup in europe and is thia configurable somewhere defender portal or other portal? I have read all the docs with only option would be to redo the entire setup. If we decided to start from beginning who holds the key to set desired region for all these modules? Is this EA, Tenant Admin, Microsoft Support? also streaming logs inter continental from Europe to log analytics in eastus, whats the cost ingestion? I show several pricing model but with my use case i need ti know dollar amount per gig for both. Not happy how illusive defender operates if not careful during initial setup from admin perspective or it could have been microsoft that managed to click through without looking55Views0likes5CommentsEDR Exclusions - file extensions with square brackets
Background: We applied for, and received the ability to access EDR Exclusions for our tenant due to some performance problems we were seeing. I think this might still be an early preview feature but am not 100% sure... Here is a screenshot of what I am referring to: We have found a few other applications that had issues, including one that uses many different file extensions. Some of those files use square brackets in the extension name. This are valid files. However when I try to add them to our EDR Exclusions, I get an error "a valid extension must be specified"... which is frustrating because it is a valid extension. Does anyone have a solution for this or know how to get Microsoft to fix this? ThanksBspies1Feb 12, 2025Copper Contributor21Views0likes0CommentsAdvanced Hunting along with a Custom Detection Rule
Good afternoon, I need some help setting up a KQL query in Advanced Hunting along with a Custom Detection Rule to automatically isolate devices where a virus or ransomware is detected. The rule must run at NRT (Near Real-Time) frequency. We are using Microsoft Defender for Business, which is included in the Microsoft 365 Business Premium license. Would any kind community member be able to provide me with a starting point for this? Thank you in advance!Solvedstade1655Feb 12, 2025Copper Contributor66Views1like2CommentsStop Defender isolating Domain Controllers
Recently we have experienced Defender isolating our Domain Controllers. It is always the same rule which causes the isolation "Suspected AD FS DKM key read". I edited the rule and set it to auto resolve if triggered by the DCs. I assumed this would then release the DCs from isolation but this doesn't seem to be the case. Manual intervention is still required. I either need to stop Defender alerting this particular rule against my DCs (not ideal) or i need to stop the rule isolating the DCs. Any help would be appreciated.IanFloodFeb 12, 2025Copper Contributor61Views0likes6CommentsReplacement for Windows Authenticated Scanning
For cost saving, we were looking at replacing our existing vulnerability scanner with Defender and using device scanning. Due to the nature of some of our systems, we can't enroll all of them in Defender and had hoped to use Windows Authenticated Scanning for the unmanaged devices. It looks like that is being deprecated, and the FAQ page indicates that there is currently no direct replacement. While the number of systems we have that can't be enrolled in relatively minimal, is there any kind of scanning I'm missing as part of the product that would allow remote scans of Windows devices as opposed to enrolling? It doesn't look like it. Seems like taking away a component that gives some kind of feature parity without another option is a bad idea, but maybe I'm just missing something.26Views0likes1CommentVulnerability Management: Why don't tags show up on exposed devices?
In Vulnerability Management's Security Recommendations, there's a "tags" column for the exposed devices, but it isn't populated. Why? Wouldn't this screen be one of the most useful places to see tags? "Let's see, I need to update the software on these twenty machines. One machine has the "user on leave" tag, another one has the "pending reboot" tag - better contact that user." I shouldn't have to drill down into the devices table to check out each machine in the exposed list.SKadishFeb 06, 2025Brass Contributor45Views0likes3CommentsDefender XDR Unified Audit Logs
Hi, There used to be Unified Audit Logs -option in Defender XDR Settings under "Endpoints". This option has now disappeared. Trying to search for Defender XDR events, such as isolating devices etc. using the Purview Audit search, I don't get any results. From the XDR Action center history I can see that isolation actions have been performed. I have Security Administrator permissions. Is there a way to enable/disable the XDR auditing from Defender XDR or Purview portals?ghjneam1Feb 06, 2025Copper Contributor60Views0likes1Comment
Resources
Tags
- microsoft defender for endpoint315 Topics
- microsoft defender for office 365213 Topics
- threat hunting104 Topics
- Alerts99 Topics
- investigation90 Topics
- Incident Management72 Topics
- automation68 Topics
- learning47 Topics
- Response Actions41 Topics
- microsoft sentinel39 Topics