Microsoft Defender for Endpoint

Formerly Microsoft Defender ATP

We have visibility of what's going on and that's pretty much it, but before we don't have any visibility and it was just open for everybody. Now we could see what's going on, we could track what's going on. We could optimize the system on the recommendation that it has.

I wish there was a way to filter whatever. You could see so much things that you could see within a particular example. You scan a pc, there's hundreds of results that comes out and you want to zone it out to whatever's relevant to your incident.

From an overall endpoint protection perspective, I would say it certainly helps protect through the integration across the entire OS and software browser or what have you. Just that deep integration protects against threats, potentially internal with accidental file sharing, external files, browsers, malicious links, URLs, just the ability to have that smart screen capability built in, again throughout the entire OS really just helps protect the entire machine.

From an improvement perspective. The only thing that comes to mind is when there's a health notification on a particular action in the security center where there's maybe an action to take, whether a piece is misconfigured and it maybe click to activate set capability.

So from a negative, the only thing that really comes to mind is within the device security portal within the machine itself. Occasionally you'll get alerts such as Core Isolation, maybe after a security update or whatever, just the Windows update comes through. Maybe something might be disabled temporarily. And trying to re-enable that feature through a single click. And then a reboot doesn't always seem to stick the first time, but that's honestly the only thing that stands out.

Workspace with other Microsoft products because we have office SharePoint, use some specialized Azure Open AI tools and stuff.

Just sometimes with the updates or a reboot is necessary when it doesn't say it or a couple of reboots or a process is hanging.

It integrates perfectly with Azure Sentinel. I mean, that's great. We can have a single pane of class with other platforms, like Defender for Cloud, Defender for endpoints, and Defender for servers, which is awesome as well. The ease of deployment is because Microsoft made sure around a year ago that every single workstation with Microsoft Windows came with Defender for Endpoints embedded.

So the fact that Defender for Endpoint still works with signatures is actually, I don't know, a little difficult for us because, I mean, since Microsoft trusts those signatures, you can easily inject code. And we've done it many times. To show that you can inject code through vulnerabilities like CV 2013, 99, and 33 but still keep the signature. So because of the trust of those signatures, the malware just kind of slides into the environment without Defender knowing. That's the first part. The second part is that the behavioral analysis is not precisely its Prime. It's not Defender's best capability for endpoints. So, Defender does not identify all behaviors considered by other EDRs in the market.

It helps detect anomalies. It helps detect sensitive files that are being sent outside of the company. It pretty much provides this intel.

Would probably be documentations. If documentation can be simplified, that would've been nice.

It is very good in detecting what has happened on the endpoint. So tracking all the actions, what the user clicked, if there was a malicious program that touched the mailbox, anything like that is excellent.

While it's a very good product for auditing, it has a very hard time to distinguish what is malicious and is an attack, what is not. Very rarely we get indication of a real malicious attack. We got lots of hours for off the shelf malware that it cleans up automatically. So basically we never get to look at it, which is a positive thing, but threats are detected by the third party endpoint, so it will not be enough by itself.

What I like about this product is that they are always giving you some updates and they are always trying to add some new features. Also, they are working with copilot ai. They are always trying to do new things to add to the product.

I would let that you guys could upgrade or wrap some more features on the live response feature because I think we could do some things differently, but easier for us to manage some incidents faster.

It's very simple to install.

It's very responsive.

It doesn't create any excessive traffic on the device.

It doesn't interfere with the end user experience.

Possibly integration with the DLP module

Defender for Endpoint is updated automatically on a regular basis.

It catches a most malicous files which means it's detection works very well malware, viruses and ransomware.

Defender for Endpoint integration well with other Microsoft products. For example, it integrates well with Microsoft Sentinel SIEM solution.

Defender for Endpoint data is very useful for threat intelligence and threat hunting.

Defender for Endpoint does not support some older operating systems versions. Most organizations have legacy applications running on legacy OSs therefore some of these should be supported.

Onboarding assets is a little different depending on the operating systems that is being used. This takes away for a consistent onboarding process.

From a management standpoint, some aspects of management is handle in local SCCM while others are on the Microsoft cloud.

The best thing is the centralized reporting. So we've used other products, but this has the best one. We can easily develop a punch list and items to tackle sort things out and prioritize.

Faster updates would be nice after we make some of the changes, it takes a while, 2, 3, 4 days to see if they've actually taken the other thing that's in deficit is still need some improvement, get a few false positives.

Once there's a breach, it helps allow us to reset passwords asap, easily.

I think it's working pretty low right now, so no.

When an end user opens a file or accesses a file I should say that has malicious content, it will quarantine the file. It will also let us know if an end user themselves has an issue now. So the whole Defender Suite has different parts. So some of these may be going over into Defender for identity and stuff. I'm not clear on which is which, but it's the whole ecosystem. I'll get an email letting me know that there's an issue and then we follow up. The email generally has a link in it to the actual event in the defender for endpoint or whatever console. And then we can start looking at the case, make sure the endpoint is quarantined. So it can't do anything. The only thing we can do is talk to it to do forensics or whatever so it's not totally isolated where we have to get somebody on the ground to go to the thing. We can still work on it remotely, but the end user can't do anything that would continue to cause lateral movement of the compromise or anything like that.

As much as I've talked about loving this product, there are issues it seems like almost daily when we get into it. Something has changed or moved or the name of the overall system has changed. Microsoft needs to just stick and stay. I understand with development and their merging products and stuff, but it's really frustrating when things change daily, especially when we're doing an e-discovery investigation or DLP. It's almost an emergency situation and when you have to relearn how to do something in the system, it's very frustrating.

Protections from ransomware

AI based modern threat definitions.

End to end device security

Online documents and data security.

Privacy of clients surety

End to end device security

It has a very intuitive and user-friendly UI that enables my team and I to navigate through it and respond to any threat efficiently.

It's extensive dashboard gives a complete view of all our endpoint soo we can spot any potential threat and exposure across the networks.

Robust detection and response capabilities that detect abnormal behavior, potential threats, and attacks as they happen and remediate and block any threat.

Insights enable us to get to the root cause of incidents and alerts for deep investigation.

It also provide a powerful 365 protection against any threat.

It is pretty limited when it comes to devices that are not Microsoft-based. Adding a device is quite a task.

False positives.

Sophisticated automated investigation and response features.

Exclusions during scanning are hard to spot.

I always have to submit request for whitelisting apps.

Detects attacks as they happen.

Detects potential attacks.

Detects abnormal user behavior.

Does not allow for remediation from the management console.

The ticket system doesn't alert the person assigned to the ticket.

You have to submit requests for whitelisting applications.

Scanning exclusions are tricky to find.

Adding devices, especially Apple devices, is very cumbersome.

Provides excellent integration with 365 security suite

It tracks all activities on endpoints and helps our security team effectively investigate alerts

It uses signature and behavior based techniques to detect / block threats

It offers limited support for non-Microsoft devices

It can be sometimes difficult to setup for optimization

It can sometimes be the root issue for resource issues on the endpoints

Endpoint protection

Basis level DLP

Firewall security for endpoint.

EDR - provides basic EDR capabilities

Doesn't come as an individual product

Threat Intelligence is not upto the market standards.

Vulnerability Management is without a doubt one of the most efficient features of Microsoft Defender for Endpoint. It provides enough details about the vulnerability, its impact and the remediation as well.

The latest addition of 'Endpoint Security Policies' has been a very well thought and insightful feature that relieves the security analysts from the hassle of switching to Intune just for reviewing the endpoint security policies.

'Automated Remediation' is a boon to many organizations across the industry that helps in responding to ongoing attacks at machine speed. Microsoft Defender for Endpoint does it quite well in terms of accuracy and quickness.

Dynamic device tagging feature has been an underrated feature from Microsoft Defender for Endpoint. It is such a reliable and efficient feature that saves a lot of time whether you are dealing with vulnerabilities or incidents.

While 'Vulnerability Management' is one of my favorite features, I do feel that it has been the same for quite some time and now it should have some integration capabilities to do actions like inform the affected users, or take small actions like updating the OS, sending prompts to devices etc.

I think most people will agree with me when I say that 'Baseline Assessments' feature should now have more standards added to its inventory. CIS and STIG are the only ones available in this feature without any updates for a long time now.

Device Discovery while a good feature is appearing to somewhat unstable in nature. It does not provide admins with enough details and any actions to take on the discovered devices.

Antivirus protection

Malware protection

Quarantine and alerts

Offering with other suites in M365 family

There are cases where it is not able to detect malware but other antivirus is detecting it

Better dashboard

Protection from malware and viruses

Centralised Management

Advanced Threat Analytics

Better user interface

Easy installation

Lower price

It provides a unified security experience when combined with other Microsoft products such as Microsoft Defender for 365 and Azure Defender.

It has an excellent dashboard and centralized view that make it easy to see and control everything from one location.

It's an EDR tool designed to help you understand incidents and alerts better.

Real-time detection of attacks and prompt endpoint device responses. It effortlessly interacts with additional Microsoft security products.

I must admit that I haven't discovered anything major regarding this product.

It has limited integration options with third party security products.

Sometime Automated Response is slow.

It blocks the unsafe applications from accessing.

It provides User-friendly interface for seamless endpoint security.

It gets the updates new pattern updates automatically and stays upto date.

It has limited integration options with third party products.

Expand Baseline Assessment beyond STIG and CIS benchmarks for broader security coverage and compliance flexibility.

Nothing else.

One of the strong points is that AI is tightly integrated into the platform, which leads to excellent detection.

Vulnerability management is very useful for assessing tracking, and mitigating threats across all protected devices.

KQL integration is very good.

Licensing between Defender for Endpoint and Servers is complicated.

Deployment has improved but is not really streamlined. There is no single installer available and no single way of deploying settings.

The Defender portal is rich in information but can be complicated to use.

Defender for Endpoint uses cutting-edge threat detection technologies, such as behavioral analysis and machine learning, to recognize and neutralize both known and undiscovered threats. Even the most complex and elusive malware and exploits can be found by it.

By providing threat analytics, it enables proactive threat prevention and mitigation by assisting organizations in understanding their security posture and trends over time.

It offers immediate insight into threat activity and endpoint security. Security teams can react quickly to threats since they can see what's happening across all of the devices in their organization.

For enterprises using the platform for the first time, the initial setup and configuration can be challenging. The experience might be enhanced by streamlining the onboarding procedure and offering more user-friendly setting wizards.

It might be difficult to afford, especially for smaller firms. The solution might be more widely available if it had a more open and flexible price structure, particularly for smaller enterprises.

Organizations could better address the escalating problems with cloud security with the help of enhanced functionality for monitoring and managing cloud apps and services.

Automated incident response

Scalability

Rapid threat mitigation

Threat analytics keeping us aware of our security posture.

Transparency in alert logic and visibility

Clarity in licensing. There are many options and pricing tiers that aren't very clear at the start of deployment.

Limited baseline assessment