Defender

10 posts
blue and brown cardboard boxes

Blocking a mass spam attack (updated)

Recently a new trend has emerged where criminals are attempting to hide their activity behind a barrage of spam email to the compromised mailbox or to any popular mailbox in the domain.

brown and black butterfly on gray rock during daytime

Attack Surface Reduction = Zero Day Protection

Attack Surface Reduction (ASR) rules have expanded to include a full range of zero-day protections. If you aren't using them today or haven't tried to use them recently, then it's time to look again. If you aren't locking down Windows natively then you're missing out on critical security features.

a human is playing tug of war with an eager white golden retriever both fully engaged in the fun game

Don’t change the threat actions in anti-virus policy

Students in the Defender XDR course were advised not to alter threat actions in their anti-virus policy, leaving them as Not configured. This allows Defender to use its default behaviors, local device settings, signature-defined actions, and automatic remediation. Relying on Microsoft's security expertise ensures optimal threat management.

person wearing white pants and white socks standing beside brown broom

How to isolate a device using Defender

let's say that you've come across a situation, and you want to remove a device from the network - remotely, while you investigate. Interestingly this device, need not be enrolled in Defender for Business. It can an unmanaged device to

a man in red shirt covering his face

Error setting up Identities in Defender

To resolve this error, you need to remove three security groups from Azure AD. These groups were created by default in your tenant but have since been deprecated by Defender.

How to Defender

This is a collection of posts about Microsoft Defender. How to set, configure, troubleshoot and implement.