FedSearch
F0rm4t · @F0rm4t
41 followers · 44 posts · Server infosec.exchange
Open media

"Public preview of near real-time custom detections in Microsoft 365 Defender.

You can now create custom detection rules that run in near real-time, in addition to existing frequencies ranging from every 24 hours to every hour. These detections can be integrated with the broad set of Microsoft 365 Defender across email, endpoint, and identity, leading to faster response times and faster mitigation of threats.

This new frequency will be available in Microsoft 365 Defender as Continuous (NRT). "

techcommunity.microsoft.com/t5

#microsoftsecurity #microsoft365 #microsoft #defender #microsoft365defender #xdr #NRT #nearrealtime #detection #soc #azure #cloud #cloudsecurity #analyst #SecurityAnalyst #cybersecurity

Last updated 2 years ago
Original post

F0rm4t · @F0rm4t
41 followers · 43 posts · Server infosec.exchange
Open media

#AiTM #mfa #2fa #multifactorauthentication #azure #azuread #azureactivedirectory #defender #xdr #microsoft365defender #microsoft #microsoftsecurity #microsoft365 #conditionalaccess #antiphishing #sentinel #MicrosoftSentinel #identity #identityprotection #reverseproxy #cybersecurity #iam #iag #ueba #credentialtheft #phishing #soc #SecurityAnalyst #monitoring #risk

Last updated 2 years ago
Original post

Dustin Schutzeichel · @CloudProtectNinja
2 followers · 15 posts · Server infosec.exchange

📢 The near real-time frequency for custom detection rules with advanced hunting is now available in preview. The updated documentation highlights the tables supported for continuous rule detection:

learn.microsoft.com/en-us/micr

#microsoft365defender #advancedhunting

Last updated 2 years ago
Original post

Dustin Schutzeichel · @CloudProtectNinja
2 followers · 14 posts · Server infosec.exchange

The team collected a 3-phase guide & implementation checklists against :

1️⃣ Prepare recovery plan
2️⃣ Protect privileged roles + improve detection & response
3️⃣ Improve identity, e-mail & endpoint security

learn.microsoft.com/en-us/secu

#microsoft365defender #ransomware #M365D #mdo #MDE #azuread

Last updated 2 years ago
Original post

F0rm4t · @F0rm4t
36 followers · 41 posts · Server infosec.exchange
Open media

#microsoft #gartner #mq #epp #edr #leader #xdr #microsoft365defender #MDE #azure #cloud #cloudsecurity #mitre #endpointprotection #cybersecurity

Last updated 2 years ago
Original post

F0rm4t · @F0rm4t
36 followers · 39 posts · Server infosec.exchange
Open media

Automatic disruption of Ransomware and BEC attacks with Microsoft 365 Defender

We are excited to announce the expansion of the public preview to cover business email compromise (BEC) campaigns, in addition to human-operated ransomware (HumOR) attacks.

techcommunity.microsoft.com/t5

#microsoft #xdr #edr #defender #MDI #MDE #mdo #azure #cloud #cloudsecurity #email #bec #ransomware #microsoft365 #microsoft365defender #humor #automation #ir #incidendresponse #siem #identity #casb #endpoint #epp

Last updated 2 years ago
Original post

Dustin Schutzeichel · @CloudProtectNinja
2 followers · 11 posts · Server infosec.exchange
Open media

for Office 365 () provides more granular options for anti-spoofing policies and how you want to deal with the published config of the domain owner.

Didn‘t find official documentation by the team on this change in anti-phishing yet. Anyone who has more information?

#microsoftdefender #mdo #dmarc #microsoft365defender

Last updated 2 years ago
Original post

F0rm4t · @F0rm4t
32 followers · 34 posts · Server infosec.exchange
Open media

#xdr #microsoft #microsoft365defender #azure #edr #casb #defender #extendeddetectionandresponse #soc #KQL #siem #soar #cloud #cloudsecurity #automation #cybersecurity

Last updated 2 years ago
Original post

Gareth Emslie 🇿🇦 🇪🇦 🇨🇭 · @keyoke_za
39 followers · 254 posts · Server hachyderm.io
TECHCOMMUNITY.MICROSOFT.COM - Announcing device isolation support for Linux

Microsoft Defender for Endpoint on Linux devices can now be manually isolated from the network through the Microsoft 365 Defender portal or using APIs, helping to prevent attackers from controlling compromised devices. API Linux isolation is also available and the device can be reconnected to the network at any time. techcommunity.microsoft.com/t5

#microsoft365defender #microsoftdefender #linuxisolation

Last updated 2 years ago
Original post

F0rm4t · @F0rm4t
19 followers · 20 posts · Server infosec.exchange

Zerobot is a Go-based botnet that spreads primarily through IoT and web application vulnerabilities.

Learn how Zerobot works and how to defend devices and networks against it:

- Use Microsoft 365 Defender as security solutions with cross-domain visibility and detection capabilities

- Adopt a comprehensive IoT security solution such as Microsoft Defender for IoT, integrate it with XDR platform such as Microsoft Sentinel and Microsoft 365 Defender

- Harden endpoints with a comprehensive Windows security solution

- Ensure secure configurations for devices

- Use least privileges access

microsoft.com/en-us/security/b

#microsoft #windows #security #iot #MSTIC #azure #xdr #microsoft365defender #defenderforiot #sentinel #MicrosoftSentinel #siem #soar #cloud #cloudsecurity #zerobot #ssh #LeastPrivilege #rat #ioc #threatintelligence #ti #tip #ddos #zerostresser #webapp #vulnerabilities #cve

Last updated 2 years ago
Original post

F0rm4t · @F0rm4t
21 followers · 22 posts · Server infosec.exchange
Microsoft Security Blog - Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog

Zerobot is a Go-based botnet that spreads primarily through IoT and web application vulnerabilities.

Learn how Zerobot works and how to defend devices and networks against it:

- Use Microsoft 365 Defender as security solutions with cross-domain visibility and detection capabilities

- Adopt a comprehensive IoT security solution such as Microsoft Defender for IoT, integrate it with XDR platform such as Microsoft Sentinel and Microsoft 365 Defender

- Harden endpoints with a comprehensive Windows security solution

- Ensure secure configurations for devices

- Use least privileges access

microsoft.com/en-us/security/b

#microsoft #windows #security #iot #MSTIC #azure #xdr #microsoft365defender #defenderforiot #sentinel #MicrosoftSentinel #siem #soar #cloud #cloudsecurity #zerobot #ssh #LeastPrivilege #rat #ioc #threatintelligence #ti #tip #ddos #zerostresser #webapp #vulnerabilities #cve

Last updated 2 years ago
Original post

F0rm4t · @F0rm4t
8 followers · 12 posts · Server infosec.exchange

Supercharging Defender for Endpoint with Zeek

The integration of Zeek into Microsoft Defender for Endpoint provides new levels of network analysis capabilities based on deep inspection of network traffic.
can now monitor inbound and outbound traffic with a novel engine that is capable of:
- Session Awareness
- Dynamic Protocol Detection
- Dynamic Scripting Content

techcommunity.microsoft.com/t5

#zeek #Corelight #microsoft #defender #microsoft365defender #xdr #edr #azure #windows #linux #network #udp #tcp #networkispection #networkbaseddetections #hunting

Last updated 2 years ago
Original post

F0rm4t · @F0rm4t
4 followers · 6 posts · Server infosec.exchange
Open media

Supercharging Defender for Endpoint with Zeek

The integration of Zeek into Microsoft Defender for Endpoint provides new levels of network analysis capabilities based on deep inspection of network traffic.
can now monitor inbound and outbound traffic with a novel engine that is capable of:
- Session Awareness
- Dynamic Protocol Detection
- Dynamic Scripting Content

techcommunity.microsoft.com/t5

#zeek #Corelight #microsoft #defender #microsoft365defender #xdr #edr #azure #windows #linux #network #udp #tcp #networkispection #networkbaseddetections #hunting

Last updated 2 years ago
Original post

F0rm4t · @F0rm4t
3 followers · 5 posts · Server infosec.exchange
Open media

Firmware assessments support now in public preview in Microsoft Defender Vulnerability Management

It introduces the following new capabilities:
- New inventory for system models, processors, and BIOS across Windows, Linux and MacOS.
- Vulnerability assessment for processors and BIOS weaknesses for HP, Dell, and Lenovo.
- Evaluation of the UEFI Secure Boot mode setting for Windows and Linux.
- Ability to retrieve system model, processor, and BIOS information using export API and Advanced Hunting.

Find out more info: techcommunity.microsoft.com/t5

#microsoft #xdr #microsoft365defender #edr #vulnerability #vulnerabilitymanagement #tvm #defender #azure #bios #uefi #firmware #hardware #processor #windows #linux #macos #hunting #api #management

Last updated 2 years ago
Original post