Azure User Group Nepal

Azure User Group Nepal

Sign in Subscribe

14.0 Defender for Endpoint(MDE): Custom Detection Rule

14.0 Defender for Endpoint(MDE): Custom Detection Rule

Defender for Endpoint detects threats using its own advanced threat intelligence system based on artificial intelligence, machine learning, and behavioral analytics. Based on that intelligence database MDE generates alerts/incidents in case of suspicious activities, or attacks. We can also generate alerts/incidents based on our own intelligence in MDE.

Defender Cloud Security Posture Management (CSPM): Preview

Defender Cloud Security Posture Management (CSPM): Preview

Currently, Defender Cloud Security Posture Management (CSPM) is in public preview. What is CSPM Cloud security posture management(CSPM)is the process of continuously monitoring and assessing the security posture of cloud resources that detects/identify vulnerability, misconfiguration, and other security threats and issues. It also provides possible remediation to

13.0 Defender for Endpoint(MDE): Web content filtering

Web content filtering block or allow websites or content based on predefined rules. Microsoft Defender for Endpoint provides such a capability. MDE provides Microsoft-managed web content filtering, which means Microsoft updates a list of URLs based using artificial intelligence and machine learning. Navigate to the MDE portal (security.microsoft.com)

12.0 Defender for Endpoint(MDE): Security Settings Management

12.0 Defender for Endpoint(MDE): Security Settings Management

For the Intune-managed device, we deploy the policy from Intune but what if we have a device that is not Intune-managed and also not domain-joined then how to push security policies centrally? The answer is to use Defender for Endpoint's new feature 'Security Settings Management'. Below is the official word

10.0 Defender for Endpoint(MDE): Indicator

10.0 Defender for Endpoint(MDE): Indicator

Microsoft Defender for Endpoint has its own intelligence database and based on that it triggers alerts. If we want to trigger alerts based on our own intelligence or we can say IoC that is also possible in MDE. Defender for Endpoint has features called Indicators where we can upload all

9.0 Defender for Endpoint(MDE): Device Group & Roles

9.0 Defender for Endpoint(MDE): Device Group & Roles

In Defender for Endpoint, the device group is a collection of devices. The device group can be created based on certain criteria or characteristics like operating system, location, device type, user group, and tag. In this post, we create based the device group based on the tag. A device group

8.0 Defender for Endpoint(MDE): Device Tag

8.0 Defender for Endpoint(MDE): Device Tag

Tags are the label that we put on devices to organize the device, filter the device, create device groups, apply RBAC, apply security policy, etc. There are multiple ways to set tags on a device. In this post, we will see how to create tags from the Defender portal and

1.0 Microsoft Defender for Endpoint (MDE): Overview

1.0 Microsoft Defender for Endpoint (MDE): Overview

Microsoft Defender for Endpoint(MDE) is a cloud-based endpoint security solution by Microsoft designed to help enterprises to prevent from threats. Below are its key features. We can have more read about it at What is MDE. In this post, we want to more focus on the plan from an

5.0 Defender for Endpoint(MDE): Walk through the Portal

In previous posts, we onboarded 1 unmanaged and 1 managed device to the Microsoft Defender for Endpoint (MDE). Let's have a look at the MDE portal (security.microsoft.com) and see what it looks like from where to start with. Now, security.microsoft.com is the new home for Defender

6.0 Defender for Endpoint(MDE): Apply Security Baseline Policy

6.0 Defender for Endpoint(MDE): Apply Security Baseline Policy

In this post, we discuss how to deploy a security baseline policy from MDM for MDE to enforce security policy to manage devices to protect against known security threats. Assume the situation where we have onboarded devices to MDE and get lots of recommendations to fix. We have multiple options

7.0 Defender for Endpoint(MDE): Integrate with Compliance & Conditional Access Policy

7.0 Defender for Endpoint(MDE): Integrate with Compliance & Conditional Access Policy

In this post, we discuss how to integrate Defender for Endpoint(MDE), compliance policy, and conditional access policy to protect company resources, devices, and data by enforcing security and compliance requirements. We use Microsoft Endpoint Manager admin center (Intune) for compliance policy and Azure Active Directory for conditional access policy

4.0 Defender for Endpoint(MDE): Onboard Intune Managed windows 10/11

4.0 Defender for Endpoint(MDE): Onboard Intune Managed windows 10/11

In the previous blog post, we onboarded unmanaged windows 10 devices to the Microsoft Defender for Endpoint. In this post, we will onboard the Intune-managed devices. Manage device by Intune First, we will manage the device by Intune, in another word, onboard the device to Intune. Log in to the

3.0 Defender for Endpoint(MDE): Onboard Unmanaged Windows 10/11

3.0 Defender for Endpoint(MDE): Onboard Unmanaged Windows 10/11

This is the continuation post of the MDE series. How we onboard your device to Microsoft Defender for Endpoint (MDE) depends on the infrastructure architecture and how we are managing the endpoint devices like laptops, mobile devices, and even servers. We will start with laptops (Windows 10 and Windows 11)

Import Azure DevOps project to new Organization

Import Azure DevOps project to new Organization

There are multiple ways to move Azure DevOps project from one organization to another. In this post, we go through the easiest way which is from the DevOps portal. I have two DevOps organizations and moving the project from one to another. 1. Go to your project->Repos->Clone and

Can Application Change Analysis do the same role of FIM for Azure App Service?

Can Application Change Analysis do the same role of FIM for Azure App Service?

In this post, we will discuss, can Application Change Analysis do the same role of FIM for Azure App Service?

File Integrity Monitoring (FIM) using Defender for Cloud to comply with PCI DSS requirement

File Integrity Monitoring (FIM) using Defender for Cloud to comply with PCI DSS requirement

In this post, I want to discuss how File Integrity Monitoring (FIM) can be implemented using Microsoft Defender for Cloud which is one of the requirements of PCI DSS.

Microsoft Defender AV exclusion list bypass can go undetected by Defender for Endpoint

Microsoft Defender Antivirus exclusion list can be bypassed if the user has the administrative right or the threat actor got administrative access to the device. Microsoft Defender exclusion list from scanning is unprotected and exposed to the end-user. There are two big risks: Risk1: Privileged users or bad actors can

Azure Governance

Azure Governance - Detect when VM created/modified in your organization

Governance in Azure got ignored for small organizations or newly cloud-adopted organizations. We should not have to start big, we can start from small things that can be achieved easily. For example, you want to get notified if any resources like a virtual machine, storage account, network, etc. create or

Microsoft Defender Family - Name changed in Ignite 2021

Microsoft Defender Family - Name changed in Ignite 2021

Microsoft has changed the Defender family name in Ignite 2021. New Names Old Names

Integrate Azure Web App with NAT Gateway and vNET to get static outbound IP

Azure App Service

Integrate Azure Web App with NAT Gateway and vNET to get static outbound IP

Azure NAT Gateway, gives more control over the outbound traffic from the virtual network. It will allow you to have static outbound public IP for PaaS services. There could be many use cases of this service but here I am interested in controlling Azure Web App outbound traffic. The issue

Microsoft Defender Family/Suite Explained

Microsoft Defender Family/Suite Explained

If you are in the Microsoft cloud security space for a while then you have already known about the variants of Microsoft Advanced Threat Protection (ATP). ATP has rebranded/renamed as Microsoft Defender now and broadens its family members. If you are new in this space like me then it's

Azure Sentinel analytics queries (custom detection rules) to create incidents - Part 1

Azure Sentinel analytics queries (custom detection rules) to create incidents - Part 1

If you are new to the Azure Sentinel or have configured all the Data connectors but not sure what to do next while learning then this post might give you direction to move forward. Why not start with something simple that we work on day to day as a cloud

How to join Azure File Share to Active Directory Domain Controller

How to join Azure File Share to Active Directory Domain Controller

Azure Files authentication against Server Message Block (SMB) for Active Directory Domain Service (AD DS) was due for a long time and now it's available. This post will quickly show how to enable it. First of all, you need to Join the Azure File Share to the domain. You can

Azure WVD - Complexity removed by spring 2020 release

Azure WVD - Complexity removed by spring 2020 release

Azure WVD spring 2020 release announces many new capabilities and one of them is Azure Resource Manager (ARM) service support. Earlier, WVD was not native to ARM due to that there were lots of complexity to deploy it. If you have already deployed an earlier WVD version then you have

How to write YAML file for Azure Kubernetes Service (AKS)

Azure Kubernetes

How to write YAML file for Azure Kubernetes Service (AKS)

There are primarily two parts of the Azure Kubernetes Service (AKS) deployment, first deploy the AKS cluster and second deploy an application. To create the AKS Cluster, we can use Azure Portal, Azure CLI, ARM Template, etc., and to deploy an application to the AKS cluster we can use a