(Preview) Use matching analytics to detect threats. Take advantage of threat intelligence produced by Microsoft to generate high-fidelity alerts and incidents with the Microsoft Defender Threat Intelligence Analytics rule. This built-in rule in Microsoft Sentinel matches indicators with Common Event Format (CEF) logs, Windows DNS events with domain and IPv4 threat indicators, syslog data, and more. Learn more on our docs.

Webinars

We have the following two upcoming webinars:

• Data Tiering Best Practices (Oct 29 2024, 09:00 AM – 10:00 AM (PT))
• Mastering API Integration with Sentinel & Unified Security Platform (Dec 5 2024, 09:00 AM – 10:00 AM (PDT))

Last month, these two webinars have been presented and the recordings are now available:

• Deep Dive: Moving from the Log Analytics Agent to the New Azure Monitor Agent
• Building Microsoft Sentinel integrations – Part 2: Creating data connectors

Guidance for handling CUPS remote code execution vulnerability using Microsoft Security capabilities.

In this blogpost we will demonstrate how you can easily discover if your organization is vulnerable to this critical unauthenticated RCE flaws in CUPS printing systems and view guidelines on remediation. 

Ninja Show: In this 2 episodes, we explore Microsoft Security Exposure Management, learning how it quantifies risks, generates reports for key stakeholders, unifies the security stack, and optimizes attack surface management. Watch the recordings of Part 1 and Part 2.

Microsoft Unified RBAC roles are added with new permission levels for Microsoft Threat Experts customers to use Ask Defender experts capability. Learn more on our docs.

We released various new data in advanced hunting via the CloudAppEvents table

– Anomaly data

– Conditional Access app control / inline data

– OAuthAppId

We published a new short training video (6 minutes) for App Governance. 

Threat actors are using non-human app identities as an attack vector and unfortunately this isn’t as well understood as it should be. Customers who own Defender for Cloud Apps can turn on app governance with a few simple clicks and light up powerful capabilities.

Watch this short4 minutes training video on “How to investigate email messages in Microsoft Defender for Office 365″. 

Ninja Show episode:

• In-depth defense with dual-use scenario: We are joined by Senior Product Manager Manfred Fischer and Cloud Solution Architect Dominik Hoefling to explore the built-in protection mechanisms in Defender for Office 365. Tune into this episode as we dive deep into a dual-use scenario demonstration to learn how customers using third-party email filtering services can still leverage the powerful features and controls of Defender for Office 365.
• Bulk Sender Insights in Microsoft Defender for Office 365: In this episode, Senior Product Manager Puneeth Kuthati explains the importance of bulk sender insights within Defender for Office 365. Discover how these insights help differentiate trustworthy bulk senders from potential threats, tackle the challenges of fine-tuning bulk email filters, and strike the right balance to ensure important emails reach your inbox without overwhelming it. By analyzing sender behavior and trends, organizations can strengthen email security, reduce unwanted bulk traffic, and minimize false positives.