Become a Microsoft Defender Ninja

Hey Heike, HeikeRitter​ 

Many of the videos aren't working, the links throw an error. 

Request you to check and update them, which shall be of great help to the community.

Hey Heike, this is such a good resource thank you. a few of the videos are no longer working for me - 

Module 1. Technical overview

• Short overview “What is Microsoft Defender XDR" (4:08 mins)

Module 4. Threat Intelligence

• Overview of Threat Analytics (4:25 mins)

Thank you all for the rich info shared here!

HeikeRitter your videos are Great, you ask the exact right questions.

Keep up the Great work!

chrkuznos yay, congrats and welcome to the Ninjas 🙂

Thank you HeikeRitter for sharing! Count one more Ninja 😉

Great course. Thanks so much for all your efforts HeikeRitter and team!

Was thinking that I did request the certificate but could not find it back in my archive so did the knowledge check today and submitted the certification request today.

Was good learning again.

Thanks HeikeRitter 

Hi all, many thanks for this Training HeikeRitter et al.! I am not feeling like a Ninja quite yet, but I am getting there 🙂
Just a little bug I discovered: In the intermediate Section, in Module 7. Reporting, the link doesnt seem correctly set. I was expecting some info on out-of-the-box reporting but was led to an Overview article about XDR. Cheers

Thanks for gathering these resources together. I completed the training and this is useful in getting started with Microsoft 365 Defender. Just a few remarks below. HeikeRitter 

I noticed the link for "Module 6. Self-healing" / "Report a false positive/negative to Microsoft for analysis" is pointing to the same page as the item just above it in the list ("Approve or reject pending actions") It is currently pointing to page https://docs.microsoft.com/en-us/microsoft-365/security/mtp/mtp-autoir-actions?view=o365-worldwide whereas I suspect the link it was supposed to be is this one: https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir-report-false-positives-negatives?view=o365-worldwide

In the Expert knowledge check, there's a question "Which of the following attributes do you need to include in a query to create a custom detection rule from it?" and we are given a multiple choice with the following possible answers:

• Timestamp, DeviceId
• ReportId, DeviceId
• Timestamp, ReportId

Could it be these possible answers are not 100% correct? (In other words, that none of these answers is accurate). In the resources, I found the below information which is related to that question and seems to indicate that at least 3 attributes need to be included. The third option might match best but given the fact that there also needs to be a third attribute, I found the question to be somewhat ambiguous.

https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?view=o365-worldwide

Required columns in the query results
To create a custom detection rule, the query must return the following columns:

• Timestamp—used to set the timestamp for generated alerts
• ReportId—enables lookups for the original records
• One of the following columns that identify specific devices, users, or mailboxes:
  DeviceId
  DeviceName
  RemoteDeviceName
  RecipientEmailAddress
  SenderFromAddress (envelope sender or Return-Path address)
  SenderMailFromAddress (sender address displayed by email client)
  RecipientObjectId
  AccountObjectId
  AccountSid
  AccountUpn
  InitiatingProcessAccountSid
  InitiatingProcessAccountUpn
  InitiatingProcessAccountObjectId

Kind regards.

Joeri

Great learning resources, thank you HeikeRitter! It would be even nicer if we could turn the certificate of completion into a credly cert.