Security Operation - Part 6

 Microsoft 365 Defender topic's Continues in this series - part 6

As i said, Microsoft Defender is a unified enterprise defence suite, it does the functionality of  coordinates, detection, prevention, investigations and response against across all the end points, identities, email and apps to provide integrated protection against sophisticated attacks. In simple, It protects all the M365 serves / workloads, like one drive, exchange online, share point, Azure services

M365 defender solution is not a single applications, it is suite running across all the M365 services.

Microsoft defender for Office 365 ( O365, ATP)

Microsoft defender for Identity ( Azure ATP)

Microsoft defender for End Points ( M365 Defender ATP)

Microsoft defender for cloud apps

Microsoft defender for cloud

Microsoft defender for vulnerability management

Azure AD identity protection

Microsoft DLP

App Governance 

Key Terms in M365 Defender

M365 defender using the below three key terms on this services . These three terms plays an important role in M365 defender

XDR, SIEM, SOAR

• XDR : Extended Detection and Response
• SIEM : Security Information and Event Management
• SOAR : Security Orchestra and Automated Response

Term 1 : Extended Detection and Response (XDR)

XDR is the next phase in  advanced security , which is integrated threat protection, and deliver intelligent automated and security across the domain

It unifying the endpoints, emails, apps and identity security in one place

It is kind of Armed force in military , working in the  border of all office 365 serveries and its covered boarded security across all the domains

How it works : It uses AI and ML ti combine the signals from end points, identities, applications, data and email etc.  

Term 2 : Security information and Event Management - SIEM

SIEM gathers logs and events from various applications and software with in IT infra and then it review all the logs and events for potential threats. 

It reports in dashboard. The tool which helps in SIEM is called SENTINEL. It then automatically analysis the threats across the domain services, azure M365, Hybrid  , then it build a complete picture of each attacks and threats in a single dashboard

Term 3 : Security Orchestra and Automated Response - SOAR

SOAR is a next level of automated response of potential events identifies as threat in the logs files and imitate the work flow or trigger an action against the threat

if a device is logged in from the Unknown locations, it will initiate a work flow / trigger an action to take the device offline and send an alert to the security operation response team for further investigation

In simple word, It will initiate the automate work flow against the threats