Defender for Endpoint Firewall Rules Not Applying to Devices
Hello Security Experts, I’m currently deploying Microsoft Defender for Business and trying to enforce firewall configurations directly from the Defender portal. However, I’ve noticed that the settings are not applying to any of the onboarded devices — nothing changes on the endpoints. Do firewall rules in Defender for Endpoint require Intune to be enforced, or should they work standalone? And if Intune isn’t used, what’s the best approach to apply consistent Defender firewall rules across devices? Thanks, LucaAutomating Defender Alerts with CISA KEV and n8n – Has anyone tried similar workflows?
Hi everyone, I’ve been experimenting with n8n automation to improve vulnerability management. I created a workflow that cross-references Microsoft Defender for Endpoint vulnerabilities with the CISA Known Exploited Vulnerabilities (KEV) catalog, and then automatically creates Jira tickets for remediation. The flow takes about 16 seconds to run and prioritizes only the CVEs that are both present in the environment and listed in KEV. Has anyone here built similar automation (maybe with Logic Apps, Power Automate, or Sentinel playbooks)? Would love to hear how others handle vulnerability prioritization or ticket creation!Automação de Alertas do Defender com o Catálogo KEV da CISA usando n8n
Overview Recently, I decided to explore how automation could help simplify daily security operations, especially in vulnerability management. While studying n8n, an open-source automation platform, I saw the opportunity to connect it with Microsoft Defender for Endpoint and the CISA Known Exploited Vulnerabilities (KEV) Catalog. The goal was simple: build an automated workflow that identifies which vulnerabilities detected in Defender are actively exploited in the wild, and then create actionable tickets in Jira for remediation teams — automatically and with full context. Why I Built This Most security teams deal with thousands of vulnerabilities every week, but only a small portion are actually being exploited. I wanted to find a way to prioritize what truly matters without adding more manual work. Defender for Endpoint already provides strong vulnerability data, but by combining it with the CISA KEV catalog, we can instantly highlight high-risk CVEs that need urgent attention. This project was also a great opportunity to test n8n’s flexibility and API-handling capabilities in a real-world cybersecurity scenario.Defender Experts | Sentinel Automation based on Defender Experts Notifications (DENs)
Based on invaluable customer feedback, we're rolling out the first installment of our Defender Experts “cookbook”—a guide to enhance your experience with Sentinel automation based on Defender Experts Notifications (DENs). This customer-driven initiative reflects the importance our customers place on efficient SIEM automation to manage their operations effectively. This guide is a direct response to your insights. Think of it as a recipe book tailored to maximize the power of Defender Experts services. From optimizing DENs for automation to sharing pro tips, the guide is a collaborative effort to fortify our collective defense against evolving cyber threats. This collaborative effort reflects our commitment to transforming customer input into actionable solutions, with each new “recipe” empowering customers to navigate the complexities of the cybersecurity terrain with the confidence that Microsoft Defender Experts have their back. We encourage users to experiment with these insights and share their experiences, contributing to an ongoing dialogue that strengthens collective defenses against evolving cyber threats. Your success and protection against advanced threats is at the heart of our mission, and we look forward to continuing this collaborative journey together. Defender Experts | Sentinel Automation – NEW Defender Experts Notifications In order to configure automation rules based on NEW Defender Experts Notifications (DENs), follow the conditions below: Select Trigger When Incident is Created Select If Incident provider Equals Microsoft Defender XDR AND Select Title Contains Defender Experts Configure the relevant Actions you would like to enable based on the conditions selected above. For example, you can select a specific playbook to run or assign a particular owner to the Incident. Screenshot of Sentinel Automation Rule Trigger and Conditions based on NEW Incidents issued as DENs Defender Experts | Sentinel Automation – EXISTING Incidents that are upgraded to DENs In order to configure automation rules based on EXISTING Incidents that are upgraded to Defender Experts Notifications (DENs), follow the conditions below: Select Trigger When Incident is Updated Select If Incident provider Equals Microsoft Defender XDR AND Select Alerts Added AND Select Title Contains Defender Experts Configure the relevant Actions you would like to enable based on the conditions selected above. For example, you can select a specific playbook to run or assign a particular owner to the Incident. Screenshot of Sentinel Automation Rule Trigger and Conditions based on EXISTING Incidents Upgraded to DENs
