Microsoft Purview - Insider Risk Management
Microsoft AI User Group Hyderabad What are the Problems statements you faced while Implementing Insider Risk Management for different clients ? Any Common Problems and Challanges which is similar to Financial Services Organization and You have used similar approach or build a Unique Solution to solve this ? Regards, Subhajit Bhuiya
High values CVE's not showing on High priority observations
Hi, I need some help to understand this logic on Defender EASM. For example, on my "High priority observations", I've got 6 observations, all of those for 1 domain, which is fine. But then if I go to my inventory and select one other domain, I can see on that host, some CVE's with High priority. Screenshot bellow: So, why arent' this results being shown on the list of "High priority observations" if they are ranked with High priority. Is there a logic for this? Thanks
Microsoft Secure score not updating after implementation of Attack Surface Reduction
<p>Hello everyone,</p> <p>I wanted to share that we have successfully implemented <strong>Attack Surface Reduction (ASR)</strong> rules across our endpoint devices as part of our ongoing security hardening efforts. These configurations are actively deployed and enforced through Intune ASR to help mitigate common attack vectors like Office macro abuse, executable content from email/web, and other high-risk behaviors.</p> <p>However, we’ve noticed that despite this implementation, some ASR-related recommendations are still appearing in Microsoft Secure Score. This can occur due to delays in telemetry updates, device reporting issues, or Secure Score metrics not immediately reflecting policy enforcement across all endpoints.</p> <p>We are currently reviewing the underlying data and device reporting to ensure full visibility and alignment with Secure Score.</p>Become a Microsoft Defender External Attack Surface Management Ninja: Level 400 training
Learn to become a Microsoft Defender External Attack Surface (Defender EASM) Ninja! This blog will walk you through the resources you'll need to master and derive maximum value from Microsoft's Defender EASM product.Analytic rules for Microsoft Sentinel based on MS EASM
Hi, I just imported EASM data to Sentinel, so we can create some analytic rules based on EASM data. I'm now thinking on which use cases are interesting to create alerts. Anyone has already followed this path and has some experience of what kind of alerts make sense based on EASM data? ThanksDefender EASM source IP addresses/location
Hey, I am currently building a service that will leverage EASM for discovery and scan for all our customers. However I have a very specific constraint : the scan must be done from a France-localized IP address. Does the resource location (FranceCentral in my case) make the scan occur from a french IP address? I didn't find anything in the blog nor the documention about the scan source IP address or the the scan source location. I'd be glad to hear from the EASM team! 🙂
New Blog | Leverage Generative AI to expedite attack surface investigations in Defender EASM
By Soham Patel A prerequisite to securing an organization on the internet is first knowing what digital assets in the organization are internet-facing. With the constantly changing internet, the migration to multi-cloud environments, the evolution of organizations with mergers and acquisitions, and the emergence of shadow IT, it is often difficult to maintain an updated external view of an organization’s attack surface, leading to security gaps emerging for attackers to exploit. Microsoft Defender External Attack Surface Management (EASM) solves this challenge by discovering externally facing assets and identifying their risk. Their vulnerabilities can be identified, which helps with prioritizing them, so you know where to start with remediation efforts. While Defender EASM equips organizations with an updated external attack surface view and the risks associated with it, these vast, multifaceted attack surfaces require many resources to analyze each asset and its associated metadata. This often increases the time to remediation and the likelihood of an attacker exploiting a security gap. However, generative AI can expedite this analysis process, enabling security professionals to defend organizations at machine speed. Read the full post here: Leverage Generative AI to expedite attack surface investigations in Defender EASM
Microsoft Defender EASM should be part of Microsoft Defender XDR
Microsoft Defender EASM should be part of Microsoft Defender XDR. Microsoft Defender EASM should not work as one of the service in Microsoft Azure. It should be part of Exposure management in Microsoft Defender XDR. Already Microsoft is trying to consolidate its Security/Defender platforms in to one platform Microsoft Defender XDR. So at the same time why creating new portal for this?New Blog | Leverage Generative AI to expedite attack surface investigations in Defender EASM
By Soham Patel A prerequisite to securing an organization on the internet is first knowing what digital assets in the organization are internet-facing. With the constantly changing internet, the migration to multi-cloud environments, the evolution of organizations with mergers and acquisitions, and the emergence of shadow IT, it is often difficult to maintain an updated external view of an organization’s attack surface, leading to security gaps emerging for attackers to exploit. Microsoft Defender External Attack Surface Management (EASM) solves this challenge by discovering externally facing assets and identifying their risk. Their vulnerabilities can be identified, which helps with prioritizing them, so you know where to start with remediation efforts. While Defender EASM equips organizations with an updated external attack surface view and the risks associated with it, these vast, multifaceted attack surfaces require many resources to analyze each asset and its associated metadata. This often increases the time to remediation and the likelihood of an attacker exploiting a security gap. However, generative AI can expedite this analysis process, enabling security professionals to defend organizations at machine speed. At Microsoft Ignite in November 2023, we announced Defender EASM’s prompting capabilities in Copilot for Security. Today, we are thrilled to share that the same capabilities – and more – are available in public preview the Copilot chat pane in the Azure portal and can be used alongside Copilot for Security customers’ Defender EASM resources. This allows organizations to stay secure, with ease. Dig into your external attack surface The Copilot chat pane in Azure gives customers AI-driven insights on risky assets within their external attack surface. Instead of manually drilling down to investigate asset details, simply ask Copilot about recently expired SSL certificates and domains, and you’ll get automated answers for each in seconds. To understand which assets may have Common Vulnerabilities and Exposures (CVE), you can quickly find out by asking Copilot “which assets have critical severity CVEs?” or “Does this ‘CVE ID’ impact me?” Knowing where CVEs lie, and how they are classified, will help you in focusing resources and remediation efforts on those that matter most. Our Copilot capabilities also enable customers to quickly identify assets impacted by specific risks and vulnerabilities, such as assets that have Common Vulnerability Scoring System (CVSS) scores, that are still using SHA-1 certificates, or are expiring soon – empowering them to determine what assets must be remediated first. For example, we can investigate which assets are impacted by medium priority CVSS Scores and what vulnerabilities must be remediated to secure the targeted assets. In this scenario in the image below, we can see that because of the jQuery version, https://portal.fabrikam.com/ is at risk. Read the full post here: Leverage Generative AI to expedite attack surface investigations in Defender EASM
