#DefenderForEndpoint
LightNews LightNews
nathanmcnulty.com
Over the last couple weeks, I've been mapping out the internal APIs for Defender for Endpoint for use with automation

I just finished the last of the MDE settings and pushed PowerShell examples so anyone can automate configuration of the MDE service 🥳

github.com/nathanmcnult...
nathanmcnulty/DefenderForEndpoint/AutoConfig at master · nathanmcnulty/nathanmcnulty
Contribute to nathanmcnulty/nathanmcnulty development by creating an account on GitHub.
github.com
November 11, 2024 at 7:14 AM
nathanmcnulty.com
I often complain about how you can't target MDE device groups with AV, Firewall, ASR rules, and other policies, especially for MDE settings management

Thanks to @Eric_K_Morrison, I created an Azure Automation to sync MDE device groups with Entra groups :)

github.com/nathanmcnult...
nathanmcnulty/DefenderForEndpoint/sync-mde-device-groups-to-entra-groups.ps1 at master · nathanmcnulty/nathanmcnulty
Contribute to nathanmcnulty/nathanmcnulty development by creating an account on GitHub.
github.com
November 21, 2024 at 9:42 AM
rodtrent.com
Collection of commands that will help automate the configuration of the Defender for Endpoint settings github.com/nathanmcn...

#MicrosoftDefender #Security #MicrosoftSecurity #Cybersecurity #DefenderXDR #MicrosoftThreatIntelligence
nathanmcnulty/DefenderForEndpoint/AutoConfig at master · nathanmcnulty/nathanmcnulty
Contribute to nathanmcnulty/nathanmcnulty development by creating an account on GitHub.
github.com
November 11, 2024 at 11:36 AM
nathanmcnulty.com
I am very excited to announce I have published the first revision of my automated MDE service configuration script using the internal service APIs

github.com/nathanmcn...

Next I'll add automated AV/ASR/FW config in Intune and add better error handling and logging, then Maester!
nathanmcnulty/DefenderForEndpoint/AutoConfig/Configure-MDE-Full.ps1 at master · nathanmcnulty/nathanmcnulty
Contribute to nathanmcnulty/nathanmcnulty development by creating an account on GitHub.
github.com
December 18, 2024 at 10:23 PM
nathanmcnulty.com
In case anyone is interested, here's a script to gather Defender logs and create a performance recording, then compress it and upload it to Azure blob storage

This works via Live Response, Intune scripts, etc. Just need Create permissions on a SAS token.

github.com/nathanmcn...
nathanmcnulty/DefenderForEndpoint/Performance/upload-logs-to-blob-storage.ps1 at master · nathanmcnulty/nathanmcnulty
Contribute to nathanmcnulty/nathanmcnulty development by creating an account on GitHub.
github.com
December 21, 2024 at 6:48 AM
vacyber.bsky.social
Use #KQL to identify the use of Portable Apps across your #DefenderforEndpoint devices

github.com/alexverboon/...
April 5, 2025 at 3:06 PM
vacyber.bsky.social
[Tip!] Still running MMA for Defender for Endpoint on older Windows Servers/Clients? Not sure? Then check out these queries:

github.com/alexverboon/...

#DefenderForEndpoint #Security #StayCurrent
February 5, 2025 at 9:48 PM
dougdoestech.bsky.social
🚀 Need to control USB device access in your organization? Here is how I created a policy using Intune! Learn how to block unauthorized USBs and ensure data security. Watch now! 📺🔒 #CyberSecurity #Intune #DefenderForEndpoint youtu.be/TpPPjQfBzCI
Control USB Devices using Defender for Endpoint and Intune (Device Control)
YouTube video by Doug Does Tech
youtu.be
December 6, 2024 at 6:04 PM
vacyber.bsky.social
[New Blogpost] - Modern Security for Legacy Systems
- Defender for Endpoint on Windows 7

medium.com/@verboonalex...

#DefenderXDR #DefenderforEndpoint #Windows7
Medium
https://medium.com/p/modern-secur…
November 30, 2025 at 1:52 PM
pjrouse.bsky.social
Having worked extensively with Attack Surface Reduction (ASR) Rules recently, I thought it would be good to share some knowledge in relation to ASR alerting (or in some cases the lack of).

paul-82465.medium.com/asr-rule-ale...

#DefenderforEndpoint #ASR #MDE #AttackSurfaceReduction
ASR Rule Alerting — Don’t assume!
Over the last few years I’ve helped many organisations deploy Microsoft Defender for Endpoint, and when it comes to implementing Attack…
paul-82465.medium.com
March 3, 2025 at 10:58 AM
pvanderwoude.bsky.social
New blog post: Getting started with the Microsoft Defender Browser Protection extension for Google Chrome
petervanderwoude.nl/post/getting...
#MSIntune #Intune #EMS #MDM #Windows10 #Windows11 #GoogleChrome #MDE #DefenderForEndpoint #SmartScreen
June 9, 2025 at 6:05 PM
rodtrent.com
Securing Your Organization with Attack Surface Reduction (ASR) in Defender for Endpoint rohitanandblog.subst...

#MicrosoftDefender #DefenderforCloud #Security #MicrosoftSecurity #Cybersecurity #DefenderXDR #MicrosoftThreatIntelligence
Securing Your Organization with Attack Surface Reduction (ASR) in Defender for Endpoint
#DefenderforEndpoint
rohitanandblog.substack.com
March 20, 2025 at 5:40 PM
levacloud.com
@levacloud.bsky.social Tamper Protection in Microsoft Defender for Endpoint - Learn how to configure and enforce it in our newest blog post to prevent attackers from disabling security settings.

levacloud.com/2025/02/25/t...

#DefenderForEndpoint #TamperProtection #Levacloud #MicrosoftSecurity
February 25, 2025 at 7:21 PM
nathanmcnulty.com
To understand how to get the sccauth/xsrf token values, you can check out my documentation of the MDE internal APIs here (which I also just updated!)

github.com/nathanmcn...

Eventually this could be a PS module for all of Defender XDR, but I'm waiting for some changes first :p
nathanmcnulty/DefenderForEndpoint/AutoConfig/README.md at master · nathanmcnulty/nathanmcnulty
Contribute to nathanmcnulty/nathanmcnulty development by creating an account on GitHub.
github.com
December 18, 2024 at 10:23 PM
shehanperera.bsky.social
✨ #blog An excellent feature to close the gap when endpoints aren’t registering with Entra and not enrolling in Intune as expected.

#MicrosoftEntra #DefenderXDR #DefenderforEndpoint #EndpointSecurity #MicrosoftIntune

wp.me/pb2Sd0-2rZ
How a Synthetic Registration in Entra ID Can Protect the Devices ASAP with Defender for Endpoint?
One of the popular queries I have got by working with many customers for their Defender for Endpoint deployment projects is We need the Defender Security Policies to be assigned and working as soon…
wp.me
November 27, 2024 at 3:33 PM
qiita-trending.bot.chrs.to
MDE導入で見落とされがちなDefenderパターンファイル配布方式の設計ポイント

#Security #アンチウィルス #mde #DefenderforEndpoint #MDAV
MDE導入で見落とされがちなDefenderパターンファイル配布方式の設計ポイント - Qiita
想定読者 ・Microsoft Defender for Endpoint（MDE）の設計や導入に関わる方 ・Microsoft Defender Antivirus（MDAV）のパターンファイル更新や配布方式について理解したい方 ・更新方式の選択や設計判断に悩んでいる...
qiita.com
July 3, 2026 at 10:20 AM
hendryadrian.bsky.social
Microsoft Defender for Endpoint is previewing automatic isolation for compromised devices, limiting lateral movement and speeding incident containment while keeping endpoints connected for monitoring. #Microsoft #DefenderEndpoint #AttackDisruption
Microsoft Defender can now automatically isolate hacked endpoints
Microsoft is testing a new Defender for Endpoint capability that can automatically isolate compromised devices to stop lateral movement and reduce the impact of attacks. The preview feature keeps isolated endpoints connected to Microsoft Defender for Endpoint for monitoring and is part of automatic attack disruption. #Microsoft #DefenderforEndpoint
www.hendryadrian.com
May 26, 2026 at 3:00 PM
rodtrent.com
Hunting the Threats Using a Broader XDR with Defender for Endpoint rohitanandblog.subst...

#MicrosoftDefender #DefenderforCloud #Security #MicrosoftSecurity #Cybersecurity #DefenderXDR #MicrosoftThreatIntelligence
Hunting the Threats Using a Broader XDR with Defender for Endpoint
#DefenderforEndpoint
rohitanandblog.substack.com
March 19, 2025 at 3:30 PM
attackthesoc.com
Would love if we could have the domain categorization info as part of the Domain page in the Defender portal instead of having to go digging in the web protection reports

#DefenderforEndpoint
November 11, 2024 at 3:05 PM
robbevddaele.bsky.social
In my latest blog post, I wanted to talk about the nuances most organizations overlook with #defenderforendpoint device isolation and containment, and how these capabilities can co-exist next to containment actions via networking equipment.

hybridbrothers.com/device-isola...

#Microsoft
Device isolation and containment strategies
Introduction As a Security Operation Center, you want to be able to contain devices and users on a network as a response to an adversary event. However, depending on the security stack you are usin...
hybridbrothers.com
December 9, 2024 at 10:09 PM
pjrouse.bsky.social
Excited to share my latest article on Medium: “Level Up Your Defender for Endpoint Deployment with Custom Compliance”!

paul-82465.medium.com/level-up-you...

#Defender #MDE #DefenderForEndpoint #M365Security #DefenderXDR
Level up your Defender for Endpoint deployment with Custom Compliance.
Having worked on many Microsoft Defender for Endpoint (MDE) deployments and migrations I know how important it is to ensure that the…
paul-82465.medium.com
January 12, 2026 at 10:30 AM
pikepulse.tech
New #DefenderforEndpoint updates: faster onboarding for Windows/Linux, custom telemetry, and new predictive shielding actions to harden exposed endpoints.
Stay ahead → learn.microsoft.com/en-us/defend...
What's new in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint
Learn about the latest Microsoft Defender for Endpoint preview and generally available (GA) features, and security features in Windows 10 and Windows Server.
learn.microsoft.com
January 12, 2026 at 8:57 AM
tomwechsler.bsky.social
Microsoft 365 Defender for Endpoint - Microsoft Graph and PowerShell - List alerts for advanced hunting!
@microsoft.com @microsoft365.bsky.social @github.com @mvpaward.bsky.social #Microsoft #MicrosoftGraph #PowerShell #mvpbuzz #Security #coolstuff #DefenderForEndpoint
👇👇👇
github.com/tomwechsler/...
Microsoft_Graph/Microsoft_365/Defender/Defender_alerts.ps1 at main · tomwechsler/Microsoft_Graph
Manage Azure and Microsoft 365 with the Microsoft Graph PowerShell SDK! - tomwechsler/Microsoft_Graph
github.com
December 10, 2024 at 4:48 PM
tomwechsler.bsky.social
Microsoft 365 Defender for Endpoint - Advanced hunting on suspicion with Kusto Query Language!
@microsoft.com @msftsecurity.bsky.social @github.com @microsoft365.bsky.social #Microsoft #KustoQueryLanguage #EMS #mvpbuzz #Security #coolstuff #DefenderForEndpoint
👇👇👇👇
github.com/tomwechsler/...
github.com
December 8, 2024 at 3:20 PM
levacloud.com
From onboarding failures to passive mode conflicts and network blocks, our latest guide breaks down the most common causes (and how to fix them) so you can restore full protection fast.

levacloud.com/2025/10/29/d...

#MicrosoftDefender #EndpointSecurity #DefenderForEndpoint #MDESecurity #Levacloud
October 29, 2025 at 12:28 PM