Microsoft Defender XDR
Use Cases and Deployment Scope
We use Microsoft Defender XDR to provide centralized threat detection and response across endpoints, identities, email and Microsoft 365 services. It helps us protect against phishing, malware, ransomware, account compromise and other similar threats. It's been very effective for monitoring and securing corporate endpoints, user accounts, mailboxes and cloud services.
Our IT team use it for continuous threat detection, incident investigation and remediation primarily.
Our IT team use it for continuous threat detection, incident investigation and remediation primarily.
Pros
- Phishing and email threat protection - It gives us good visibility into who received a message, who interacted with it, and allows us to remove malicious emails from mailboxes quickly if needed.
- Endpoint Security and investigation - we can see what processes are running, investigate suspicious activity, and quickly determine whether a device has been impacted by malware or other threats.
- Identity Protection - by identifying unusual sign-in activity and other behavior that could indicate an account has been compromised, it makes it far easier to spot and isolate before it becomes a bigger issue.
Cons
- Feature Distribution - Microsoft has been consolidating their security tools, but features are often accessed through different admin portals which can be frustrating as an administrator.
- Licensing Complexity - Understanding which license is needed for specific security features can be challenging, particularly for organizations like ours with mixed licensing models.
- False Positives - Initial tuning is often required to reduce the number of false positives, which can initially overshadow genuine threats that the security team need to be aware of.
Return on Investment
- Faster threat detection and response
- Improved operational efficiency (by consolidating multiple security functions into one platform and automating tasks)
- Reduced investigation time
Usability
Other Software Used
Microsoft 365, Bitdefender GravityZone, Microsoft Purview eDiscovery, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, Exclaimer, WordPress
