Possibility of monitoring below via Defender for Endpoint

[dilanmic]

Hi All,

We have a requirement of getting done below things from Defender for Endpoint. I would appreciate it, if anyone let me know what are the things capable and if not, do we have any work arounds for that?

• Filter global threat actors/hackers information based on Origin, target group, target country, target industry etc.
• block inbound/outbound malicious network(reverse TCP/BIND) traffic via firewalling
• automatically update known behaviors/threat to adversary groups
• capability of receiving notifications to Teams

thanks in advance

regards,

Dilan

[#2]

@dilanmic Thanks for your questions Dilan.

For your question on: 

• capability of receiving notifications to Teams

You can add this capability using MDE APIs. You can use Microsoft Flow (or your Security Orchestration Automated Response (SOAR) service) to call Microsoft Teams. Here is an example of integration with Microsoft Defender for Cloud Apps (What is Defender for Cloud Apps? | Microsoft Docs). Instead of the Microsoft Defender for Cloud Apps you can replace with the Microsoft Defender for Endpoint APIs: Integrating Microsoft Teams with Microsoft Cloud App Security - Microsoft Tech Community

I'll respond to your other questions as well.

[#3]

For this one:

• block inbound/outbound malicious network(reverse TCP/BIND) traffic via firewalling

Are you interested in monitoring blocks on inbound/outbound malicious network connections? If so, you can do this. You can see more info here: Auditing - Win32 apps | Microsoft Docs

snippet below:

Object Access

Filtering Platform Connection {0CCE9226-69AE-11D9-BED3-505054503030}

Allowed and blocked connections: 5154 Listen permitted 5155 Listen blocked 5156 Connection permitted 5157 Connection blocked 5158 Bind permitted 5159 Bind blocked [!Note] Permitted connections do not always audit the ID of the associated filter. The FilterID for TCP will be 0 unless a subset of these filtering conditions are used: UserID, AppID, Protocol, Remote Port.