Microsoft Defender for Endpoint Reviews

We have two phases with Defender for Endpoint because we have been using it on mobile since 2019, and we started this year changing out our Carbon Black Symantec deployment with Defender for Endpoint on our computers. Currently, the Defender for Endpoint deployment on computers like clients is mainly just a one-to-one takeover from Symantec. In the long run, we are exploring possibilities to use it for more advanced functions as it can work as a sensor and comply with the policies in Defender for Cloud apps and DLP policies.

From a security point of view, our mobile clients allow us to sleep at night. The current implementation on our client is economical because we have the E5 license, which we have anyway. In the long run, it would mean a more secure information security posture for our company, but we need to implement it first and then start the second phase.

I'm working with Azure and Microsoft Defender for Endpoint, which is used for threat hunting. This tool is installed in environments to monitor network activity, detect potential intrusions, and identify hacking attempts. I perform threat intelligence by running KQL commands to analyze activities and follow Microsoft's best practices to reduce system intrusion risks. Additionally, I work with Azure cloud platform, which offers various services including virtual environments. For instance, if a small SME requests assistance in reducing costs and setting up IT infrastructure across five different sites, instead of extensive spending, I advise them to deploy a virtual desktop. This saves money since all necessary network infrastructures are set up in the cloud, allowing them to use what they pay for at specific times.

It took considerable time to understand and utilize Microsoft Defender for Endpoint, especially learning KQL. Despite my knowledge of SQL, I believe new users would benefit from additional video guidance on usage and running their own threat hunting.

There are numerous tools available, but for organizations already using Microsoft, such as Office 365, Microsoft Defender for Endpoint focuses on securing environments and monitoring activities. Every environment faces different threats, whether from insider threats or countries attempting to steal data or assets. Microsoft Defender for Endpoint detects anomalies and provides best practices for resolving or mitigating specific risks.

One of the best features of Microsoft Defender for Endpoint is its database for identifying zero-day attacks or malware attacks. The service runs continuously, even when users are offline. This enables me to receive notifications about irregularities, conduct investigations, and resolve issues, ultimately creating policies or procedures to prevent similar incidents.

The solution offers real-time updates on ongoing attacks affecting assets or companies. It provides automatic detection of ransomware, spyware, or phishing attacks, which is crucial for preventing ransomware infiltration. It protects the cloud environment using AI and machine learning, enhancing speed. The built-in cost feature is important as expenses increase with additional features.

My current use cases for Microsoft Defender for Endpoint include primary Defender MDE, Endpoint Detection Response EDR. I also use it mainly for attack simulator, which is for phishing deployments.

Microsoft Defender for Endpoint has changed significantly for the better. I appreciate that it has MD integrated with it. The cloud app feature is beneficial. The attack surface feature where phishing simulations can be performed is quite neat. I definitely appreciate the vulnerability assessment capability. These are significant key features that I find valuable.

We have used Microsoft Defender for Endpoint for various purposes, from tracking different vulnerabilities to monitoring potential issues with attacks.

Defender for Endpoint has significantly improved our security posture. We run two MDRs, and Defender catches more threats than the other. We've benefited from fewer attacks, reduced risk, and less exposure. We passed our recent physical penetration test audit with excellent results, partially due to Microsoft Defender.

Because of the notification and reporting, our mean time to resolution has drastically reduced. It's easier to find the issue by clicking through the notifications. Our SOC team has saved a lot of time, allowing them to focus on audits and other tasks. 

The solution is primarily used for securing endpoints, mainly desktops and laptops.

We're taking the adoption in phases. We started with endpoints and we want to expand into other capabilities at the application level.

We use Microsoft Defender for Endpoint as an Endpoint Detection and Response (EDR) tool, as well as for vulnerability management.

I appreciate how easily Microsoft Defender for Endpoint integrates with our environment and the wide variety of logs it provides compared to other EDR tools. The policies provided are quite effective and easy to implement, which simplifies the onboarding of newcomers. We continually test new policies, making threat detection and response efficient. Automation capabilities have allowed us to create workflows that automate detecting true or false positives.

Our primary use case for Microsoft Defender for Endpoint is desktop security.

Defender for Endpoint has improved our security posture by ensuring that malicious websites aren't accessed, thereby enhancing desktop and network security.

The visibility into our attack surface provided by Defender for Endpoint is good.

Defender for Endpoint has significantly reduced our SOC team's workload by automating threat detection and response, allowing them to focus on other critical projects. This increased efficiency has minimized security concerns and freed up several hours per week for the team.

We are primarily a Microsoft environment, but we also utilize a few Macs. Microsoft Defender for Endpoint functions effectively across both platforms.

Currently, I'm working to build out DLP policies in Defender for Endpoints.

Defender for Endpoint enables us to see vulnerabilities on certain endpoints and investigate the attack surface. We've improved our Security Score to the industry standard. The solution has reduced the mean time to remediation, but it's hard to give a precise number because it varies on a case-to-case basis. Automatic remediation of certain vulnerabilities has allowed our SOC to work on other projects.