Browsing Category
Microsoft Defender XDR
24 posts
Microsoft Defender XDR brings together signals across identity, endpoint, email, and cloud. This category focuses on cross-domain detection, correlation, and incident response.
The articles explore how incidents are built, how alerts relate to each other, and how XDR improves investigation efficiency. Emphasis is placed on understanding detection context, not just responding to alerts.
This category is core to SOC operations and advanced detection engineering.
AI agent runtime protection in Microsoft Defender for Endpoint
Discovery tells you an agent exists. It doesn’t tell you when someone tries to hijack it. That’s the…
Microsoft Defender for Endpoint custom data collection: get the telemetry you need
If you’ve been working with Microsoft Defender for Endpoint (MDE) for any length of time, you’ve probably run…
Getting started with OpenCTI: threat intelligence connected to Microsoft Sentinel
For the past few years, MISP has been my go-to for threat intelligence. It’s open source, flexible, and…
Microsoft Defender for Identity sensor guide (v3.x)
In a previous post on modernsecurity.nl, I walked through the classic installation of Microsoft Defender for Identity (MDI)…
Manage your live response library directly in Microsoft Defender
If you’ve been using live response in Microsoft Defender for Endpoint for a while, you’ve probably felt the…
UEBA behaviors layer in Microsoft Sentinel: from raw logs to behavioral intelligence
Every SOC analyst knows the feeling. An alert fires. You open the incident. And then the real work…
Microsoft Defender for Cloud Apps: AI agent monitoring and real-time protection
Low-code platforms like Microsoft Copilot Studio make it easy for business users to build and deploy AI agents…
Proactively Block Cloud Apps (like AI) with Microsoft Defender for Cloud Apps and Defender for Endpoint
Shadow IT remains one of the biggest challenges for security teams. Users access cloud applications daily without IT…
Microsoft Sentinel data lake: implementation guide
What is Microsoft Sentinel data lake Microsoft Sentinel data lake is a purpose-built, cloud-native security data platform that…
Automatic Attack Disruption in Microsoft Defender XDR
The reality of modern ransomware response Picture this: It’s 2 AM. Your on-call engineer gets an alert about…