Azure User Group Nepal

Azure User Group Nepal

Sign in Subscribe

Understanding Data Security Posture Management (DSPM)

Understanding Data Security Posture Management (DSPM)

In today’s digital landscape, safeguarding sensitive data is paramount. Data Security Posture Management (DSPM) is an emerging approach that helps organizations manage and secure their data assets effectively. This blog will delve into the key aspects of DSPM, its benefits, and how it can be implemented using tools like

Administrative and Security Aspects of Security Copilot

In this blog post, we will delve into the administrative and security aspects of Microsoft Security Copilot. We'll cover how to enable plugins, assign user roles, who has the authority to enable plugins and the activities that can only be performed by the owner. Login to https://securitycopilot.microsoft.com/

Exploring Security Copilot Promptbooks with Examples

Security Copilot

Exploring Security Copilot Promptbooks with Examples

In this blog post, we delve into the innovative world of Microsoft Security Copilot Promptbooks. Promptbooks are a powerful collection of predefined prompts designed to streamline and enhance the process of investigating security incidents. By leveraging these promptbooks, security professionals can efficiently and effectively respond to potential threats and vulnerabilities.

Exploring Security Copilot Prompts with Examples

Security Copilot

Exploring Security Copilot Prompts with Examples

In this blog post, we delve into the powerful capabilities of Microsoft Security Copilot by exploring various prompts and their practical applications. We'll demonstrate how to retrieve critical information, such as which VM registry has been modified and which VMs are experiencing continuous access attempts from attackers, all managed by

Setup Microsoft Security Copilot in Your Tenant

Security Copilot

Setup Microsoft Security Copilot in Your Tenant

This blog will guide you through setting up Microsoft Security Copilot. Before we dive in, let's review the key requirements you'll need to meet to get started. Azure Subscription: You must have an Azure subscription to purchase and manage Security Compute Units (SCUs), which are essential for the performance of

Types of Attack for Generative AI-Powered Applications

Types of Attack for Generative AI-Powered Applications

Generative AI is a type of AI technology capable of producing various types of content, including text, imagery, audio, and synthetic data. There are numerous Generative AI-powered applications, with some of the most popular ones being OpenAI's ChatGPT and Microsoft's Copilot family, which includes Copilot for M365, Copilot for Security,

CNAPP Solution: Microsoft Defender for Cloud

CNAPP (Cloud Native Application Protection Platform) is a term first coined by Gartner in 2021 as a unified security solution for the cloud. What is CNAPP CNAPPs are the leading edge of cloud security. A CNAPP unifies security and compliance capabilities to prevent, detect, and respond to modern cloud security

Microsoft Copilot for Security: Elevating Microsoft Security Technology

Microsoft Copilot for Security: Elevating Microsoft Security Technology

In the ever-evolving landscape of cybersecurity, staying ahead of threats is a constant challenge for organizations worldwide. Microsoft Copilot for Security emerges as a beacon of innovation, leveraging the power of Generative AI to revolutionize how security teams operate. Microsoft Copilot for Security (aka Microsoft Security Copilot) is not a

Score-Based vs Risk-Based Recommendations in Defender for Cloud

Score-Based vs Risk-Based Recommendations in Defender for Cloud

Within Microsoft Defender for Cloud (MDC), security recommendations play a crucial role in enhancing your cloud security posture. Currently, MDC has score-based recommendations and a new risk-based recommendation is coming that is in preview. In this post, we discuss why Microsoft is switching to the risk-based recommendation. First, let’s

Retirement of the Log Analytics agent

Retirement of the Log Analytics agent

Microsoft has decided to retire the Log Analytics Agent in August 2024. Log Analytics agent is used to collect logs and performance data from Azure Virtual Machine or any machine onboarded to Azure using Azure Arc. Currently, the Log Analytics Agent collects the logs and sends them to the Log

15.0 Defender for Endpoint(MDE): Endpoint Security policy

15.0 Defender for Endpoint(MDE): Endpoint Security policy

The device onboarded to Defender for Endpoint (MDE) needs a security policy applied to manage Defender security settings. Once the device receives the policy, the Defender for Endpoint components on the device enforces the policy and reports the device's status. There are many ways to apply policy: 1. Using Intune

14.0 Defender for Endpoint(MDE): Custom Detection Rule

14.0 Defender for Endpoint(MDE): Custom Detection Rule

Defender for Endpoint detects threats using its own advanced threat intelligence system based on artificial intelligence, machine learning, and behavioral analytics. Based on that intelligence database MDE generates alerts/incidents in case of suspicious activities, or attacks. We can also generate alerts/incidents based on our own intelligence in MDE.

13.0 Defender for Endpoint(MDE): Web content filtering

Web content filtering block or allow websites or content based on predefined rules. Microsoft Defender for Endpoint provides such a capability. MDE provides Microsoft-managed web content filtering, which means Microsoft updates a list of URLs based using artificial intelligence and machine learning. Navigate to the MDE portal (security.microsoft.com)

Defender Cloud Security Posture Management (CSPM): Preview

Defender Cloud Security Posture Management (CSPM): Preview

Currently, Defender Cloud Security Posture Management (CSPM) is in public preview. What is CSPM Cloud security posture management(CSPM)is the process of continuously monitoring and assessing the security posture of cloud resources that detects/identify vulnerability, misconfiguration, and other security threats and issues. It also provides possible remediation to

12.0 Defender for Endpoint(MDE): Security Settings Management

12.0 Defender for Endpoint(MDE): Security Settings Management

For the Intune-managed device, we deploy the policy from Intune but what if we have a device that is not Intune-managed and also not domain-joined then how to push security policies centrally? The answer is to use Defender for Endpoint's new feature 'Security Settings Management'. Below is the official word

10.0 Defender for Endpoint(MDE): Indicator

10.0 Defender for Endpoint(MDE): Indicator

Microsoft Defender for Endpoint has its own intelligence database and based on that it triggers alerts. If we want to trigger alerts based on our own intelligence or we can say IoC that is also possible in MDE. Defender for Endpoint has features called Indicators where we can upload all

9.0 Defender for Endpoint(MDE): Device Group & Roles

9.0 Defender for Endpoint(MDE): Device Group & Roles

In Defender for Endpoint, the device group is a collection of devices. The device group can be created based on certain criteria or characteristics like operating system, location, device type, user group, and tag. In this post, we create based the device group based on the tag. A device group

8.0 Defender for Endpoint(MDE): Device Tag

8.0 Defender for Endpoint(MDE): Device Tag

Tags are the label that we put on devices to organize the device, filter the device, create device groups, apply RBAC, apply security policy, etc. There are multiple ways to set tags on a device. In this post, we will see how to create tags from the Defender portal and

1.0 Microsoft Defender for Endpoint (MDE): Overview

1.0 Microsoft Defender for Endpoint (MDE): Overview

Microsoft Defender for Endpoint(MDE) is a cloud-based endpoint security solution by Microsoft designed to help enterprises to prevent from threats. Below are its key features. We can have more read about it at What is MDE. In this post, we want to more focus on the plan from an

5.0 Defender for Endpoint(MDE): Walk through the Portal

In previous posts, we onboarded 1 unmanaged and 1 managed device to the Microsoft Defender for Endpoint (MDE). Let's have a look at the MDE portal (security.microsoft.com) and see what it looks like from where to start with. Now, security.microsoft.com is the new home for Defender

6.0 Defender for Endpoint(MDE): Apply Security Baseline Policy

6.0 Defender for Endpoint(MDE): Apply Security Baseline Policy

In this post, we discuss how to deploy a security baseline policy from MDM for MDE to enforce security policy to manage devices to protect against known security threats. Assume the situation where we have onboarded devices to MDE and get lots of recommendations to fix. We have multiple options

7.0 Defender for Endpoint(MDE): Integrate with Compliance & Conditional Access Policy

7.0 Defender for Endpoint(MDE): Integrate with Compliance & Conditional Access Policy

In this post, we discuss how to integrate Defender for Endpoint(MDE), compliance policy, and conditional access policy to protect company resources, devices, and data by enforcing security and compliance requirements. We use Microsoft Endpoint Manager admin center (Intune) for compliance policy and Azure Active Directory for conditional access policy

4.0 Defender for Endpoint(MDE): Onboard Intune Managed windows 10/11

4.0 Defender for Endpoint(MDE): Onboard Intune Managed windows 10/11

In the previous blog post, we onboarded unmanaged Windows 10 devices to the Microsoft Defender for Endpoint. In this post, we will onboard the Intune-managed devices. Manage device by Intune First, we will manage the device by Intune, in other words, onboard the device to Intune. Log in to the

3.0 Defender for Endpoint(MDE): Onboard Unmanaged Windows 10/11

3.0 Defender for Endpoint(MDE): Onboard Unmanaged Windows 10/11

This is the continuation post of the MDE series. How we onboard your device to Microsoft Defender for Endpoint (MDE) depends on the infrastructure architecture and how we are managing the endpoint devices like laptops, mobile devices, and even servers. We will start with laptops (Windows 10 and Windows 11)

Import Azure DevOps project to new Organization

Import Azure DevOps project to new Organization

There are multiple ways to move Azure DevOps project from one organization to another. In this post, we go through the easiest way which is from the DevOps portal. I have two DevOps organizations and moving the project from one to another. 1. Go to your project->Repos->Clone and