Use eBPF-based sensor for Microsoft Defender for Endpoint on Linux

#MDE #M365D #security #linux #eBPF

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-support-ebpf?WT.mc_id=AZ-MVP-5004810

#M365D near real-time detections are now supported for the following tables

▫️CloudAppEvents
▫️IdentityDirectoryEvents
▫️IdentityLogonEvents
▫️IdentityQueryEvents

All other tables and more information can be found in the documentation 📃

https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-detection-rules?WT.mc_id=AZ-MVP-5004810#tables-that-support-continuous-nrt-frequency

Changes to Microsoft Defender for Office 365 #Sentinel connector

▫️ Improved sync of alerts and incidents
▫️ increased number of alerts
▫️ Changes to the schema ⚠️

Disconnect and reconnect to get the new benefits

#M365D #MDO

https://learn.microsoft.com/en-us/azure/sentinel/whats-new?WT.mc_id=AZ-MVP-5004810#changes-to-microsoft-defender-for-office-365-connector-alerts-that-apply-when-disconnecting-and-reconnecting

Defender for Identity release 2.207

Silent installations now support an AccessKeyFile instead of the AccessKey provided via cmdline

#MDI #M365D #security #AD

https://learn.microsoft.com/en-us/defender-for-identity/install-sensor?WT.mc_id=AZ-MVP-5004810#defender-for-identity-sensor-silent-installation

Incident Response: Investigating a Ransomware Incident

Pt 1: https://rodtrent.com/8yu

Pt 2: https://rodtrent.com/352

#MicrosoftDefender #Security #MicrosoftSecurity #Cybersecurity #M365D

Microsoft Defender for Identity Recommended Actions: Unsecure Account Attributes https://rodtrent.com/f26

#MicrosoftDefender #Security #MicrosoftSecurity #Cybersecurity #M365D

Mastering Microsoft Defender Threat Intelligence: Detonation Intelligence File Hash and URL Search https://rodtrent.com/cg5

#MicrosoftDefender #Security #MicrosoftSecurity #Cybersecurity #M365D #MicrosoftThreatIntelligence

Taking Actions on MDE Devices via PowerShell and MDE API https://rodtrent.com/z6f

#MicrosoftDefender #Security #MicrosoftSecurity #Cybersecurity #M365D #PowerShell

DCA-DetectAADInternalsUse.kql - Detect AADInternals use, where we see a domain changed from managed to federated, and the issuer contains any.sts or the issuer suffix is 8 characters, a combination of letters and numbers

https://rodtrent.com/9li

#MicrosoftDefender #Security #MicrosoftSecurity #Cybersecurity #M365D #KQL #MustLearnKQL