Should you 'Enable EDR in block mode' in Defender for Endpoint?
If you work on Defender 365 Portal, then there is a good chance you would have seen a security recommendation to Enable EDR in block mode just like the one below.
Endpoint detection and response (EDR) in block mode is a capability in Microsoft Defender for Endpoint that turns EDR detections into blocking and containment of malicious behaviors. This provides an additional layer of post-breach blocking of malicious behavior, malware, and other artifacts that your primary antivirus solution might miss.
When EDR in block mode detects malicious behaviors or artifacts, it stops related running processes, blocking the attack from progressing. These blocks are reported in Microsoft Defender Security Center, where security teams can see details of the threat and remediation status and investigate further for similar threats as necessary.
When EDR in block mode is turned on, and a malicious artifact is detected, Microsoft Defender for Endpoint blocks and remediates that artifact. Your security operations team will see detection status as Blocked or Prevented in the Action center, listed as completed actions.
Now that we know what EDR is capable of doing, I think it is safe to assume that turning it on, even with Microsoft Defender AV as your primary solution, is the wise thing to do. While EDR in block mode will not provide any additional scanning, it will allow Microsoft Defender Antivirus to take automatic actions on post-breach, behavioral EDR detections.
Before turning EDR in block mode, there are certain pre-requisites that need to be considered.
1. You must have either the Global Administrator or Security Administrator role assigned in Azure Active Directory in order to turn on the EDR feature.
2. Devices must be running one of the following versions of Windows:
¬Windows 10 (all releases)
¬Windows Server, version 1803 or newer
¬Windows Server 2019
¬Windows Server 2016 (only when Microsoft Defender Antivirus is in active mode)
3. Devices must be onboarded to Defender for Endpoint.
4. Devices must have Microsoft Defender Antivirus installed and running in either active mode or passive mode.
5. Microsoft Defender Antivirus must be configured such that cloud-delivered protection is enabled. Here is a quick snapshot of the setting -
6. Microsoft Defender Antivirus platform must be running 4.18.2001.10 or above.
7. Microsoft Defender Antivirus engine must be running 1.1.16700.2 or above.
Once you have the above pre-requisites addressed, you should be good to enable EDR. This is how you can do it.
1. Navigate to Microsoft 365 Defender Portal > Settings > Endpoints > Advanced features > Enable EDR in block mode.
2. Toggle the setting between On and Off and select Save preferences.
After you enable EDR in block mode, it can take some time for the policies to apply on the onboarded devices for Defender for Endpoint and for the compliance data to update on Defender 365 Portal. In my experience, it nearly took 24 hours for the data to update on Defender. Once it did, the onboarded machines dropped from the security recommendation and no longer showed up as exposed devices.
Conclusion
While EDR in block mode works best for devices running 3rd party AV solution with Defender AV running in passive mode, there is actually no harm in enabling it for devices that are installed with Defender as the primary AV solution. In fact, Microsoft recommends it. However, from the list of the pre-requisites called out in post above, one does need to make sure that Microsoft Defender Antivirus is kept up to date always. This is because the Defender for Endpoint stack of capabilities works in an integrated manner and it requires Defender AV to kept up to date at all times for EDR in block mode to be effective. Just ensure that you have the scan enabled as shown below -
Comments
Post a Comment