Browsing Category
Microsoft Defender for Endpoint
5 posts
Endpoints remain a critical part of the attack chain. This category focuses on endpoint detection, investigation, and response using Microsoft Defender for Endpoint.
Articles explore detection logic, attack simulation, live response capabilities, and DFIR workflows. Rather than generic EDR discussions, the focus is on how Defender for Endpoint behaves in real attack scenarios and how it integrates into broader XDR investigations.
You will also find content on advanced topics such as selective isolation, response automation, and how endpoint telemetry supports threat hunting and exposure analysis.
This category is designed for security professionals responsible for endpoint security operations and incident response.
AI agent runtime protection in Microsoft Defender for Endpoint
Discovery tells you an agent exists. It doesn’t tell you when someone tries to hijack it. That’s the…
Microsoft Defender for Endpoint custom data collection: get the telemetry you need
If you’ve been working with Microsoft Defender for Endpoint (MDE) for any length of time, you’ve probably run…
Manage your live response library directly in Microsoft Defender
If you’ve been using live response in Microsoft Defender for Endpoint for a while, you’ve probably felt the…
Selective Isolation in Defender for Endpoint – Combining tools like Velociraptor for DFIR
With the introduction of Selective Isolation, Microsoft Defender for Endpoint has taken a significant step toward more flexible…
Microsoft Defender for Endpoint (MDE) Endpoint Deception capability for Advanced Threat Detection
Microsoft Defender for Endpoint (MDE) introduces Endpoint Deception, an advanced security feature designed to detect and deter cyber…