#Modern Workplace

  Microsoft Defender XDR (Rebranded and formerly known as Microsoft 365 Defender) has many features and as part of Advanced hunting under incident & response, Custom detections is a great way to create rules to monitor events and system states proactively, including suspected breach activity and misconfigured endpoints. One can then enable & configure response actions using various device & identity attributes and set them to run at regular intervals, generating alerts. Custom detections uses Advanced hunting which is based on the Kusto Query Language (KQL) which is a powerful tool that uses schema entities organized in a hierarchy similar to SQL. The language is expressive, easy to read and understand. To manage custom detections, you need to be assigned one of these roles permissions at a minimum: - Security settings - Security administrator - Security operator To understand Custom detections better, I wanted to explore the possibility of initiating a response a...

  There are loads of reports in Defender which can be deemed more than just fit for purpose. Particularly the  Device Health report that gives plenty of insights into the the status of Defender Antivirus. If you are on a look out for gathering the Defender AV status, then you can easily find it over here. Let's say that you want to gather details on the Defender onboarding status of Windows devices. With the default reports, you can go under each modes and extract the data. You can then filter for Windows OS as a platform and get the list. But is there a better way? You bet!  Enter Defender Advanced Kusto query language.. With Kusto operators and statements one can construct queries and locate information across the Defender schema. I have been working with KQLs for some time now and I can't imagine working with Defender without Advanced hunting. In order to query for Defender onboarding modes, one can use the DeviceTvmSecureConfigurationAssessment which contains an asse...