User Profile
P4tr8k
Brass Contributor
Joined Jul 06, 2021
User Widgets
Recent Discussions
Re: Re-install MDE.Windows extension
Hi, i have the same problem. It's impossible to install this using Extension so in my case i manualy install this package (you can download it from security.microsoft.com -> Settings -> Endpoint -> Onboarding). You can try do this in another way - uninstall all installed product (in this case only ARC because MDE is not installed) and install this one more time - and here should be normal automatic deploy process (if you have configure automatic agent provisioning). Regards!23KViews0likes2CommentsRe: Ninja Cat Giveaway: Episode 4 | Defender Experts for Hunting Overview
Defender Experts are people who help search for and respond to threats in the organization. You could say it's a kind of external SOC. Threat Hunting is the proactive process of searching and identifying threats and risky/unusual behavior within an organization perimeter.51KViews1like0CommentsRe: Restart Windows 10 and 11 from MDE
Unfortunately not. Here is no any information for user and restart should be performed immediately. But if you want to play with scripts you can write powershell script (force restart) and upload and run this script using Live Response session. But it's a long process.5.5KViews0likes1CommentRe: Defender For Endpoint P1 And P2 Can Onboard Windows Server On-Prim ?
Hi, Defender for Endpoint licenses is designed to Endpoint Devices only (Workstation + Mobile). As you can see in the attached picture you can implement it like you did but it is not license compliant. If you want deploy Defender For Servers you should use Defender for Cloud for Servers.1.8KViews0likes1CommentRe: Advanced Hunting for last full scan
Hey 🙂 Try this: DeviceEvents | where ActionType contains "AntivirusScan" | extend AdditionalFields = todynamic(AdditionalFields) | extend ScanType = AdditionalFields.["ScanTypeIndex"] | project Timestamp, DeviceName, ActionType, ScanType | where ScanType contains "Full" and ActionType contains "AntivirusScanCompleted" If you want see other status than Completed remove "and ActionType contains "AntivirusScanCompleted""5.6KViews0likes1CommentRe: Azure Security baseline for Defender for Cloud
Hi, This point applies to collecting logs from Azure Resources not directly from Defender for Cloud. Here you have a link describing what data you can and you should collect: https://learn.microsoft.com/en-us/azure/defender-for-cloud/monitoring-components1.5KViews0likes1Comment
Recent Blog Articles
No content to show