#m365defender — Public Fediverse posts

Microsoft has announced that its Defender for Endpoint and Defender for Identity now support local data residency in India. This move is part of Microsoft's commitment to aligning with local data sovereignty requirements, enabling customers to onboard confidently knowing their data will remain within the Indian boundary. This helps them meet regulatory obligations and maintain control over their data.

In addition to India, these services are also available in the United States, European Union, United Kingdom, Australia, and Switzerland. New deployments are automatically created in the Azure region closest to your location. Existing customers can check their deployment geo within the portal or contact Customer Service and Support for a tenant reset if they want to update their service location. For more information on this topic or how you can benefit from it as a customer or potential user of Microsoft's services visit [this link](https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/host-microsoft-defender-data-locally-in-switzerland/ba-p/4141490).
Post generated with the help of Azure OpenAI GPT4 🤖 #msftadvocate #M365Defender #DefenderXDR https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/host-microsoft-defender-data-locally-in-india/ba-p/4215053

Have just discovered why some KQL in Defender has been erroring and I am in disbelief.

You cannot have a line break between a let statement and the next line of code!

e.g.
let myName=“TJ”;

|EmailEvents
| where …

will cause a “No Tabular expression statement found” error. removing that linebreak between let and |EmailEvents fixes the issues.

KQL is weird :)

#KQL #Defender #m365defender #cybersecurity #kusto

🚨 #KQL Course Update and Anniversary Discount!

The "Hands-On Kusto Query Language (KQL) for Security Analysts" course has been updated with 5 new exercises focusing on aggregations to answer investigative questions, with more to come! The course now offers:
✅ Lots of examples in the lessons
✅ A total of 23 exercises
✅ 2 Investigation scenarios
allowing you to enhance your skills in Kusto Query Language.

Last ~24 hours to get it 30% OFF!

https://academy.bluraven.io/hands-on-kusto-query-language-kql-for-security-analysts

#KQL
#SecurityAnalysis
#Training
#ThreatHunting
#IncidentResponse
#MicrosoftSentinel
#MicrosoftDefender
#M365Defender
#DFIR
#DataAnalysis

🚀 "Hands-On KQL for Security Analysts" Course is Now Live!

After months of dedicated work, fine-tuning, and anticipation, I am thrilled to invite you to begin your journey in mastering KQL. Whether you're a seasoned security analyst or aspiring to enhance your skills, this course is the gateway to elevating your expertise!

✅ Ready to Begin?
Embark on your learning journey today. Click the link below to enroll and take the first step toward becoming a KQL expert!

https://academy.bluraven.io/hands-on-kusto-query-language-kql-for-security-analysts

#KQL #SecurityAnalysis #Training #ThreatHunting #IncidentResponse #MicrosoftSentinel #MicrosoftDefender #M365Defender #DFIR #DataAnalysis

🚀 Exciting News for Security Analysts! 🚀

I'm thrilled to announce the first-ever "Hands-On Kusto Query Language (KQL) for Security Analysts" training course! 🛡️

After numerous requests for training content, I've decided to take the plunge and create a comprehensive KQL course tailored specifically for security professionals. It's just about a month away from the launch, and I couldn’t be more thrilled!

If you want to learn KQL for Microsoft Sentinel or Microsoft 365 Defender, check the details and sign up to get notified at launch! 🥳

https://training.bluraven.io/

#KQL #SecurityAnalysis #Training #ThreatHunting #IncidentResponse #MicrosoftSentinel #MicrosoftDefender #M365Defender #DFIR #DataAnalysis

How Microsoft Sentinel Safeguards Your Organization from BEC Attacks

Our recently released Solution for Business Email Compromise - Financial Fraud provides detection and hunting content to allow you to detect and respond to BEC threats at multiple stages of the attack cycle. In this blog we will discuss each stage of this cycle and how the Solution combines with Microsoft 365 Defender (M365D) to provide comprehensive coverage.

https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/fortifying-your-defenses-how-microsoft-sentinel-safeguards-your/ba-p/3934807

#microsoft #azure #sentinel #microsoftsentinel #bec #businessemailcompromise #m365defender #defender #xdr #cloudsecurity #soc #hunting #fraud #azuresecurity #analyst

𝗜𝗻𝘁𝗲𝗴𝗿𝗮𝘁𝗶𝗻𝗴 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝟯𝟲𝟱 𝗗𝗲𝗳𝗲𝗻𝗱𝗲𝗿 𝗶𝗻𝘁𝗼 𝘆𝗼𝘂𝗿 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝘀

The deployment and implementation of the Microsoft 365 Defender platform will need careful planning with the SOC team to optimize the day-to-day operations and lifecycle management of the Microsoft 365 Defender service itself.

This content explores several concepts on how to operationalize and integrate Microsoft 365 Defender with either new or existing people, processes, and technologies that form the basis for modern security operations.

Use these steps to integrate Microsoft 365 Defender into your SOC.

1️⃣Plan for Microsoft 365 Defender operations readiness

2️⃣Perform a SOC integration readiness assessment using the Zero Trust Framework

3️⃣Plan for Microsoft 365 Defender integration with your SOC catalog of services

4️⃣Define Microsoft 365 Defender roles, responsibilities, and oversight

5️⃣Develop and test use cases

6️⃣Identify SOC maintenance tasks

https://learn.microsoft.com/en-us/microsoft-365/security/defender/integrate-microsoft-365-defender-secops?view=o365-worldwide

#m365defender #defender #microsoft #xdr #soc #zerotrust #azure #cloud #cloudsecurity #securityanalyst #mdo #mde #mdi #entraid #mdca

Adversary-in-The-Middle & Business Email Compromisedthreat hunting with KQL

Find out essential points for threat hunting, focusing on how to track "potential" AiTM/BEC activities using Kusto Query Language (KQL) in Microsoft 365 Defender

https://techcommunity.microsoft.com/t5/azure-data-explorer-blog/aitm-amp-bec-threat-hunting-with-kql/ba-p/3885166

#bec #AiTM #hunting #m365defender #microsoft365defender #threathunting #microsoft #azure #soc #phishing #kql #kusto #cloudsecurity

𝗖𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗲 𝗝𝘂𝘀𝘁-𝗶𝗻-𝗧𝗶𝗺𝗲 𝗔𝗰𝗰𝗲𝘀𝘀 𝘁𝗼 𝗠𝟯𝟲𝟱 𝗗𝗲𝗳𝗲𝗻𝗱𝗲𝗿

🔵Entra ID (formerly Azure AD) offers the Privileged Identity Management (PIM) for Groups feature, enabling users to attain just-in-time membership and ownership of groups, thus governing access to a range of services.

🔵M365 Defender unified RBAC workloads offers centralized permissions management for the following services:

➡️Defender for Endpoint

➡️Defender for Identity

➡️Defender for Cloud Apps

➡️Defender for Office 365

➡️Microsoft Defender Vulnerability Management

➡️Secure score

PIM for Groups paired with M365 Defender RBAC offers a solution for just-in-time Defender access.

Find out more details: https://techcommunity.microsoft.com/t5/security-compliance-and-identity/configure-just-in-time-access-to-m365-defender/ba-p/3764564

#azure #azuread #entraid #identity #rbac #m365defender #xdr #justintime #pim #pam #mde #mdo #mdi #securescore #mdca #casb #microsoft #microsoftsecurity #soc #cloud #cloudsecurity #cloudnative

Microsoft Defender Threat Intelligence (Defender TI) is now available to licensed customers within the Microsoft 365 Defender (M365 Defender) portal, placing its powerful threat intelligence side-by-side with the advanced XDR functionality of M365 Defender.

Use Cases

➡ Advanced hunting with Defender TI IOCs against the logs and Events within Microsoft 365 Defender

➡Upload IOC to a storage account\public GitHub

➡Using KQL Externaldata operator as correlation source and proactive hunting and enabling custom detection on M365 Defender

➡M365 Defender Raw Event Detection

➡M365D Raw events flow into Sentinel with the M365 Defender Data connector

➡MDTI Feeds flow into Sentinel with MDTI Data connector

➡Manual TI correlation rule

https://techcommunity.microsoft.com/t5/microsoft-defender-threat/what-s-new-mdti-interoperability-with-microsoft-365-defender/ba-p/3799846

#DefenderTI #TI #threatintelligence #MicrosoftDefenderThreatIntelligence #xdr #soc #securityplatform #securityanalytst #m365defender #microsoft365defender #microsoft #azure #intelligence #ioc #threathunting #ttp

Microsoft Defender Threat Intelligence (Defender TI) is now available to licensed customers within the Microsoft 365 Defender (M365 Defender) portal, placing its powerful threat intelligence side-by-side with the advanced XDR functionality of M365 Defender.

Use Cases

➡ Advanced hunting with Defender TI IOCs against the logs and Events within Microsoft 365 Defender

➡Upload IOC to a storage account\public GitHub

➡Using KQL Externaldata operator as correlation source and proactive hunting and enabling custom detection on M365 Defender

➡M365 Defender Raw Event Detection

➡M365D Raw events flow into Sentinel with the M365 Defender Data connector

➡MDTI Feeds flow into Sentinel with MDTI Data connector

➡Manual TI correlation rule

https://techcommunity.microsoft.com/t5/microsoft-defender-threat/what-s-new-mdti-interoperability-with-microsoft-365-defender/ba-p/3799846

#DefenderTI #TI #threatintelligence #MicrosoftDefenderThreatIntelligence #xdr #soc #securityplatform #securityanalytst #m365defender #microsoft365defender #microsoft #azure #intelligence #ioc #threathunting #ttp