• Automatically preventing threats from accessing your organization and helping to stop attacks before they happen, 
• Reducing confusion, clutter and alert fatigue with a single dashboard to view prioritized incidents and one place to investigate and respond to incidents holistically, 
• Returning affected assets to a safe state in the broader context of an incident and automatically remediate seemingly isolated attacks. 

What is Microsoft 365 Defender? 

Microsoft 365 Defender provides XDR capabilities across Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity and Microsoft Defender for Cloud Apps in GCC, GCC High and DoD environments. Microsoft 365 Defender helps determine the full scope and impact of a threat by stitching together the threat signal received from each of these products. Microsoft 365 Defender can help identify initial threat entry, the scope of the issue, and how it’s currently impacting the organization. It also can take automatic action to prevent or stop the attack and self-heal affected mailboxes, endpoints, and user identities. 

Microsoft 365 Defender services protect: 

• Endpoints with Defender for Endpoint – Defender for Endpoint is a unified endpoint platform for preventative protection, post-breach detection, automated investigation, and response. 
• Email and collaboration with Defender for Office 365 – Defender for Office 365 safeguards your organization against malicious threats posed by email messages, links (URLs) and collaboration tools. 
• Identities with Defender for Identity and Azure Active Directory (Azure AD) Identity Protection – Defender for Identity uses your on-premises Active Directory Domain Services (AD DS) signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization. Azure AD Identity Protection automates the detection and remediation of identity-based risks in your cloud-based Azure AD. 
• Applications with Microsoft Defender for Cloud Apps – Microsoft Defender for Cloud Apps is a comprehensive cross-SaaS solution bringing deep visibility, strong data controls, and enhanced threat protection to your cloud apps. 

The post Microsoft 365 Defender delivers unified XDR experience to GCC, GCC High and DoD customers appeared first on MODIVA.

One additional capability that comes included with Defender for Servers is Microsoft Defender for Endpoint. See more details about the integrated solution here.

Background

One advantage of this native integration is the centralization of alerts, in other words, when an alert is triggered by MDE, it will be surfaced in the Microsoft Defender for Cloud / Security Alerts dashboard

If you select one alert, you can get more details about it and take action on the alert to start your investigation or remediation of it. You can also click on the link to be brought directly to the Microsoft 365 portal to investigate the alerts there.

Which dashboard should you look at?

As you can see, these alerts can be investigated from both dashboards of Microsoft Defender for Servers in the Azure Portal and from Microsoft Defender for Endpoint in Microsoft 365 Defender.

So which dashboard should you use?

The answer is your choice and lies entirely with how your Information Security Team is consuming the alerts and managing the devices.

However, we can give you some guidance on best practises that we have seen to work with many customers.

A SIEM is the recommended started point for investigation for all Defender for Cloud alerts (not just those coming from MDE).

Note: You might see duplicate alerts in Microsoft Sentinel, coming from Microsoft defender for Cloud and Defender for Endpoint. This is a known behaviour if Defender for Endpoint sensor was onboarded via Defender for Cloud.

In the absence of a SIEM and if you’re a general SOC team doing the investigation (not focused on just endpoints), we recommend that you start your investigation of alerts on Microsoft Defender for Cloud, and you can easily go to Microsoft 365 Defender to further your hunt via Defender for Endpoint.

On the other hand, if you’re a team who focuses entirely on endpoints who are doing the investigation of the alerts, then you can use just the Microsoft 365 Portal.

In summary, you can use whichever dashboard or method you choose to investigate the alerts, but you can decide based on the criteria listed above.

Culled from Microsoft Blogs

The post Defender for Endpoint and Defender for Cloud- which dashboard should you use? appeared first on MODIVA.