Advanced Threat Protection Part 5: Microsoft Defender ATP | Course Video | Online Training (2023)

00:00

Welcome submarines to the industry. 65 Security Administration Course

00:05

I'm your Strugar. Jim Daniels.

00:08

We're on module three m s, 3 65. Threat protection.

00:12

We're going to be wrapping up lesson to advanced threat protection with Microsoft Defender 80 p

00:18

This lesson we're going to earn

00:20

how Windows 10 incorporates security features into the of S

00:25

and expands with those features with defender A teepee.

00:29

We're also going to look at some specific application control methods within Windows Town.

00:35

So to this point, we've really focused on the

00:38

non of s security side where this is the lesson we're actually going to get in with Windows 10.

00:46

Here's some of security innovations with Windows 10

00:50

pre breach threat protection, identity protection, information protection, post breach security management

00:57

Some of these innovations you may or may not implement.

01:00

However, as a security professional, it is your duty to at least know

01:07

what each one is.

01:08

And the scenario which is recommended

01:11

Microsoft Defender 80 p is a platform designed to help enterprise networks prevent, detect, investigate and respond to the advanced threats.

01:21

It does that by offering threatened vulnerability management

01:26

reduction of your tax office

01:27

next generation protection

01:32

endpoint detection and response

01:34

Advance Honey,

01:36

Automated Investigation, remediation

01:40

and for a utilizes the threat experts

01:44

within Defender A TV. You can actually set up email alerts. You send notifications for specific recipients based on new alerts.

01:52

Well, our severity levels could be configured to trigger those notifications.

01:56

Some of the required permissions to configure defender 80 p email notifications.

02:01

You could be sent to manage security settings, which is a role based within defender a teepee where you can be a global or security administrator.

02:10

A tip.

02:12

It's always a good idea to configure e a p in office. 3 65 80 p settings

02:16

for Defender 80 p a large emails so they don't go into junk reform, saying

(Video) Endpoint Protection Part 5 - Defender Advanced Threat Protection (ATP) Policies

02:23

If you have a major alert coming through about a security incident,

02:27

you don't want to go into quarantine or jump.

02:30

Here's an example of that, you know are

02:32

it's a new alarm detection,

02:35

and it's detected a malicious document

02:37

as a severity

02:39

as the source as well as time

02:43

and as a direct link so you can see more information about this sort

02:49

as our security center is a unified infrastructure security management system that provides advanced threat protection across your hybrid workloads in the cloud

02:58

as well as on premises.

03:00

Defender 80 p can be integrated with as our security center

03:04

to allow a Teepee Analytics

03:07

behavioral signal collection from servers. Intelligence for emerging threats in a single pane of glass view for server and endpoint. 80 p of ours.

03:16

So this is the dream scenario. If your organization still has a one premise server footprint

03:22

as well as a

03:23

server footprint in azar,

03:25

the security center

03:28

ties on prim and cloud together

03:31

and any grace and would defender a teepee for your in points so you can have a comprehensive view of your endpoints and servers

03:42

all at once.

03:43

Windows Defender, application guard,

03:46

Windows 10 and Microsoft edge

03:50

their next

03:53

administrators defying trusted websites. Cloud internal resource is

03:58

everything else is untrusted zero trust model, right?

04:01

When on trust this side is visited, edge opens up in an isolated hyper V container,

04:09

just container separate from the host of S,

04:12

which for Texas system. In the event that the site is malicious,

04:16

you're gonna solve this from power shoe

(Video) Microsoft Advanced Threat Protection (ATP) Explained

04:18

in the control panel or as a policy compliance within NDM such as intern,

04:26

it can be configured

04:28

within group policy

04:30

S E C M or into Indian endpoint management

04:33

application. Gored is fantastic.

04:36

Let's take a look.

04:39

You have your device hardware,

04:41

you have edge the new edge. Chromium browser is actually pretty good. Pretty good word. We're hoping that will be the hope to get rid of their next four once and for all.

04:53

So we're putting a lot of stock in as chromium. That's beside the point.

04:58

So we have our Windows Defender application guard.

05:01

It launches in edge,

05:03

use the platform services. A separate colonel from the S

05:08

suffer. So something bad happens in that untrusted site.

05:13

It doesn't mess up

05:15

your host of s.

05:19

This is very cool technology.

05:21

Let's look at some application control methods. In Windows 10

05:26

you have a couple of different methods. You have Windows Defender application control,

05:30

an Apple locker.

05:31

Somebody comparisons.

05:33

Defender Application control requires Windows 10 enterprise 17 of now,

05:38

plus or windows 10

05:41

1903 and above doesn't necessarily have to be enterprised. If it's 1919 03 or above

05:46

you control what drivers and acts are allowed.

05:49

When those defender application control policies applied to a computer and affect all device users.

05:56

It's a computer based policy,

05:59

and it supplied you configure with indium. Such a Simpson SC CME Group policy or power show

06:05

ad blocker,

06:06

was introduced on Windows seven.

06:09

(Video) Microsoft Defender ATP Threat and Vulnerability Management

Control is why ask? Users are allowed to run.

06:13

Policies can apply it to all users of a computer or individual users and groups.

06:17

And it's deployed through SEC and Group policy and Power Shell.

06:23

One of the key things

06:25

when his defender application control

06:28

allows control over drivers.

06:30

That's something that Apple worker does not.

06:34

When those defender application control

06:36

mitigate security threats by restricting the applications, user are allowed to run

06:42

and the code runs in the kernel system. Core.

06:46

W jak policies also block unsigned scripts and M s eyes.

06:50

And when the power shell runs in constrained language mode,

06:55

All right, let's see if you notice

06:57

Windows 10 Application guard

06:59

functions with I E. 10 plus and the latest versions of Edge, Firefox and Chrome. Is that true? Or is that false?

07:10

False? It only functions with i e. An edge.

07:15

You do not get the application Gore function

07:17

with Windows 10 F. Your users are using Firefox or crime

07:23

or any other third party browser, such as Offer

07:27

Bruce Schneier is a cryptography expert.

07:30

He's been involved in creation of many cryptographic algorithms.

07:34

Chances already already know who he is. If you don't

07:38

there, you know, now you know,

07:46

That shows how good we are at evaluating risk.

07:50

Can you take away from this?

07:53

What we may necessarily think is a risky use

07:56

isn't necessarily

07:58

the risk is gonna have the big people behind it.

08:01

That's where Defender Export Guard comes in. Utilizes the capabilities of the intelligence security graph

08:09

to identify active exploits and count on behaviors.

08:13

To start these types of attacks at various stages of the cure. Train

(Video) Microsoft Defender ATP | Step 5 of 9 | Maintaining Microsoft 365

08:18

defender exploit guard components, therefore main ones.

08:22

It reduces your attack surface.

08:24

The set of controls prevents malware from getting when the machine, by blocking office scripts and email based threats.

08:31

This far can help protect against zero day attacks.

08:35

Network protection.

08:37

It extends the malware and social engineering protection offer about Windows Defender Smart screen

08:41

in Microsoft Edge to cover network traffic in connective ity on your devices.

08:48

This requires Windows Defender, a V

08:50

controlled folder access.

08:52

This is what I like.

08:54

It protects sensitive data from ransomware about blocking on trusted processes from accessing your protective folders

09:03

so you can actually define certain protective folders within the device itself. Within the hard drive, you can say, OK,

09:11

all of these voters are access restricted, their sensitive

09:16

You get

09:18

take process that you don't know what they are. They're levelled his own. Trusted They're never gonna right

09:22

or edit into this voters.

09:26

Export protection

09:28

is a set of exploit mitigation

09:30

replaces E met in the past. Enhanced mitigation experience took it

09:35

and could be easily configured to protect your system and applications. So it's additional tool kit that comes with defender Export Guard

09:43

To recap this lesson Microsoft Defender 80 p is a platform designed to help enterprise networks prevent,

09:52

detect, investigate

09:54

and respond to advanced threats.

09:56

Windows Defender 80 p can be integrated into as your security center

10:01

Windows application. Gord opens untrusted sites and isolated hyper V enable container

10:07

for sandbox type protection.

10:11

Thank you for joining me on this lesson.

10:13

Over. See you next time. Take care

Threat Management Plan Part 1: Security Dashboard 3m
Threat Management Plan Part 2: Threat Investigation and Response 8m
Threat Management Plan Part 3: Advanced Threat Analytics 6m
Mobility Part 2: Implementing Mobile Device Management 10m
View All

FAQs

What is the difference between Windows Defender ATP and Microsoft Defender ATP? ›

Microsoft Defender — not to be confused with Microsoft Defender ATP — provides anti-malware and anti-virus capabilities for the Windows 10 OS, whilst the ATP product is a post-breach solution that complements Microsoft Defender AV.

Is Microsoft Defender the same as advanced threat protection? ›

Windows Defender Advanced Threat Protection (ATP) is a Microsoft security product that is designed to help enterprise-class organizations detect and respond to security threats. ATP is a preventative and post-detection, investigative response feature to Windows Defender.

What is Microsoft Defender advanced threat protection ATP? ›

Office 365 Advanced Threat Protection (ATP) is a cloud-based email filtering service that helps protect your organization against unknown malware and viruses by providing zero-day protection and safeguarding versus phishing and other unsafe links, in real time.

How do you get the defender ATP portal? ›

By default, MSSP customers access their Microsoft 365 Defender tenant through the following URL: https://security.microsoft.com/ . MSSPs however, will need to use a tenant-specific URL in the following format: https://security.microsoft.com?tid=customer_tenant_id to access the MSSP customer portal.

What replaced Microsoft ATP? ›

The new Microsoft Defender is the most comprehensive XDR in the market today and prevents, detects, and responds to threats across identities, endpoints, applications, email, IoT, infrastructure, and cloud platforms.

Do I need antivirus if I have Microsoft Defender? ›

Windows Defender scans a user's email, internet browser, cloud, and apps for the above cyberthreats. However, Windows Defender lacks endpoint protection and response, as well as automated investigation and remediation, so more antivirus software is necessary.

Is there a better antivirus than Windows Defender? ›

Answer: AV- comparatives conducted tests and the results showed that while the detection rate for Windows Defender was 99.5%, Avast anti-virus led by detecting 100% of malware. Avast also has a lot of advanced features that are not available on Windows Defender.

What is Microsoft advanced threat protection called now? ›

Azure Advanced Threat Protection has changed its name to Microsoft Defender for Identity.

How much does Microsoft Defender advanced threat protection cost? ›

Microsoft Defender for Endpoint offers a free trial and several different pricing plans from $10 per user per month up to $57 per user per month. For more information, visit microsoft.com/en-us/microsoft-365/compare-microsoft-365-enterprise-plans.

What license is required for Microsoft Defender? ›

Licensing requirements

Any of these licenses gives you access to Microsoft 365 Defender features via the Microsoft 365 Defender portal without additional cost: Microsoft 365 E5 or A5. Microsoft 365 E3 with the Microsoft 365 E5 Security add-on. Microsoft 365 E3 with the Enterprise Mobility + Security E5 add-on.

Why is Microsoft Defender taking up so much CPU? ›

This issue with MsMpEng.exe taking 100% of the hard drive and CPU usually occurs when Windows Defender is scanning the computer for malware. The Windows Defender scan is getting stuck on a few files while checking malware. When that is happening, it should be restricted/disabled to bring it back to normal use.

How do I use ATP with Windows Defender? ›

Onboard the devices

In the Configuration Manager console, navigate to Assets and Compliance > Endpoint Protection > Microsoft Defender ATP Policies. Select Create Microsoft Defender ATP Policy to open the policy wizard. Type the Name and Description for the Microsoft Defender for Endpoint policy and select Onboarding.

Does Windows Defender have a firewall? ›

Because Windows Defender Firewall is a host-based firewall that is included with the operating system, there's no other hardware or software required. Windows Defender Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API).

Is defender for Cloud free? ›

Microsoft Defender for Cloud is free for the first 30 days. Any usage beyond 30 days will be automatically charged as per the pricing scheme below. Microsoft Defender currently protects Azure Blobs, Azure Files and Azure Data Lake Storage Gen2 resources.

Is defender ATP included in E3? ›

The inclusions of the Microsoft Defender for Endpoint Plan 1 into the Microsoft 365 E3 license suite will add new levels of security to E3 licensed organisations at no additional cost.

Is Microsoft Defender for Office 365 the same as ATP? ›

Microsoft Defender for Office 365 (formerly ATP) is a cloud-based email filtering service that helps protect your organization against unknown malware and viruses by providing robust zero-day protection, and includes features to safeguard your organization from harmful links in real time.

Does Office 365 include advanced threat protection? ›

Microsoft Office 365 Advanced Threat Protection pricing

Microsoft includes ATP with its top-tier Office 365 Enterprise E5 subscription, but organizations can add the service to other Exchange and Office 365 subscriptions for $2 per user, per month.

What is Azure security Center called now? ›

The Azure Defender service includes all of the previously-branded Azure Security Center threat protection technologies.

Can Windows Defender remove all viruses? ›

The Windows Defender Offline scan will automatically detect and remove or quarantine malware.

Can Microsoft Defender detect all viruses? ›

Microsoft Defender Antivirus detects and protects against the following kinds of threats: Viruses, malware, and web-based threats on devices. Phishing attempts.

Can Windows Defender scan all viruses? ›

Windows Security continually scans for malware (malicious software), viruses, and security threats.

Should I use Defender or McAfee? ›

Spoiler alert: McAfee is the best choice. Although it's not free like Microsoft Defender, McAfee ensures you get what you pay for, providing all-around protection from online threats to save you money in the longer term. Keep reading to find out how I tested both providers to select the ultimate antivirus solution.

Is Windows Defender enough in 2022? ›

Microsoft Defender antivirus is pretty safe. It has almost 100% real-time protection rates, according to independent tests. It also has additional features for device protection against malware, such as scanning, app and browser control, and account protection options.

What is difference between Azure defender and Microsoft Defender? ›

During Microsoft Ignite in November 2021, Azure Security Center and Azure Defender are now called Microsoft Defender for Cloud. They've also renamed Azure Defender plans to Microsoft Defender plans. For example, Azure Defender for Servers is now Microsoft Defender for Servers.

How many types of Microsoft Defender are there? ›

Here's a list of the different Microsoft 365 Defender products and solutions: Microsoft Defender for Endpoint. Microsoft Defender for Office 365. Microsoft Defender for Identity.

How many versions of Microsoft Defender are there? ›

It comes in Plan 1 and Plan 2 variants, with Plan 2 even including end-user security education campaigns and training material.

Can Microsoft Defender be hacked? ›

According to the researchers, hackers can potentially exploit this vulnerability to learn the list of locations excluded from Microsoft Defender scanning and plant malware there.

How does Windows Defender compare to Norton? ›

Norton 360 takes the top spot as the better antivirus option against Microsoft Defender. While Microsoft Defender provides a great real-time malware detection rate, it doesn't match up to the Norton 360, which detected and blocked every threat thrown its way.

How much is Microsoft Defender license? ›

Microsoft Defender for Endpoint has 2 pricing edition(s), from $2.50 to $5.20. Look at different pricing editions below and read more information about the product here to see which one is right for you.

Is Microsoft Defender free with Windows 10? ›

Microsoft installs Microsoft Defender for free on Windows 11 and Windows 10 computers. It covers a single device, but any secondary Windows PCs will have the same app installed.

Is defender enough for Windows 11? ›

If you're comfortable with all this — and in our experience, Edge is lighter and faster than Chrome — then Microsoft Defender Antivirus and the related protections built into Windows 10 and 11 should absolutely be good enough to protect you from malware infection, and give you a few useful extra security features as ...

Is Windows Defender enough for average user? ›

Yes, Windows Defender is a good basic virus protection software. You may not find everything you want if you are extremely security focused. A third-party antivirus or anti-malware software will likely find threats that Windows Defender may miss.

Is Windows Defender 100% accurate? ›

Its AI accurately identifies legitimate attack patterns while allowing safe software to pass. In tests using over one million software samples, Microsoft Defender Antivirus correctly caught the malware with 100% accuracy.

Why Windows Defender is not good enough? ›

While Microsoft Defender has improved over the years, it's not enough to fully secure your Windows PC. It does have some good features, like parental controls, phishing protection, and hardware security, but these features aren't as comprehensive as those offered by a premium antivirus service.

Does Windows Defender use a lot of RAM? ›

Windows Defender is a useful inbuilt tool which helps computer users like you to prevent your system from attacking by malware or viruses. However, sometimes, it will eat up high memory, CPU and disk usage.

Can I use both Windows Defender and antivirus? ›

You can benefit from running Microsoft Defender Antivirus alongside another antivirus solution. For example, Endpoint detection and response (EDR) in block mode provides added protection from malicious artifacts even if Microsoft Defender Antivirus is not the primary antivirus product.

What's the difference between Azure ATP o365 ATP and defender ATP? ›

Office 365 ATP will monitor emails, along with everyday collaboration tools such as SharePoint, One Drive, and Teams. Windows Defender ATP will protect devices associated with endpoints and enable you to identify attacks that make it past the pre-breach defense.

What is the difference between defender and defender for Endpoint? ›

Windows Defender is built into Windows 10/11 and is primarily used as a firewall and anti-virus solution. Microsoft Defender for Endpoint is a cloud-based security platform that connects Windows Defender with Microsoft's advanced threat intelligence system to provide comprehensive security to all enterprise endpoints.

Does Windows Defender detect everything? ›

As part of the Windows Security suite, it will search for any files or programs on your computer that can cause harm to it. Defender looks for software threats like viruses and other malware across email, apps, the cloud, and the web.

What apps should be allowed through Windows Defender Firewall? ›

The apps you want are your browsers like Edge, Chrome, Firefox, Internet Explorer and ports 80 and 443 to be open. That's what you want to allow. As for private and public the way that works is based on your connection. When you are at home with your machine you want to be set to private network.

Does Windows Defender cover Google Chrome? ›

Microsoft Defender Application Guard Extension is a web browser add-on available for Chrome and Firefox. Microsoft Defender Application Guard provides Hyper-V isolation on Windows 10 and Windows 11, to protect users from potentially harmful content on the web.

Does Defender have VPN? ›

Microsoft Defender for Endpoint uses a virtual private network (VPN) to provide Web Protection capabilities that protect you against phishing or web-based attacks.

Is Malwarebytes better than Microsoft Defender? ›

Comparison Results: Microsoft Defender has an edge in this comparison. According to reviews, it is more lightweight than Malwarebytes. To learn more, read our detailed Malwarebytes vs. Microsoft Defender for Endpoint Report (Updated: November 2022).

Do I need Malwarebytes if I have Defender? ›

Malwarebytes Premium is better than Windows Defender (also known as Microsoft Defender). Along with Malwarebytes, Defender offers real-time protection and on-demand scans. However, Malwarebytes also offers behavioral detection to pick up on new malware. That said, Windows Defender is better than Malwarebytes Free.

How much does one drive on an E3 license hold? ›

Microsoft will provide initial 5 TB of OneDrive storage per user. Customers who want additional OneDrive storage can request it as needed by contacting Microsoft support. Subscriptions for fewer than five users receive 1 TB OneDrive storage per user.

Is ATP an antivirus? ›

Windows Defender Advanced Threat Protection (ATP) is a Microsoft security product that is designed to help enterprise-class organizations detect and respond to security threats. ATP is a preventative and post-detection, investigative response feature to Windows Defender.

What licenses include ATP? ›

Microsoft ATP can be bolted onto many different Microsoft 365 and Exchange subscriptions:
  • Exchange Online Plan 1.
  • Exchange Online Plan 2.
  • Exchange Online Kiosk.
  • Exchange Online Protection.
  • Microsoft 365 Business Basic.
  • Microsoft 365 Business Standard.
  • Office 365 Enterprise E1.
  • Office 365 Enterprise E3.
3 Sept 2020

Is ATP now called Defender? ›

So Azure ATP is now Microsoft Defender for Identity, which works with Active Directory to protect user identities and credentials.

Is Windows Defender an antivirus for ATP? ›

Microsoft Defender ATP is a unified platform for Windows protection that includes a broad range of capabilities, some of which include: Antivirus.

What license is needed for defender ATP? ›

Licensing requirements

Windows 10 Education A5. Microsoft 365 E5 (M365 E5) which includes Windows 10 Enterprise E5.

What is azure ATP called now? ›

Azure Advanced Threat Protection has changed its name to Microsoft Defender for Identity.

How do I bypass Microsoft ATP? ›

To bypass ATP Attachment Processing, set up the following mail flow rule:
  1. Go to your MS Exchange/Office Admin Center and click "Mail Flow"
  2. Click the "+" and "Bypass spam filtering..."
  3. Give the rule a name, e.g. "Bypass ATP Attachment Processing"
  4. Hit "More Options"
25 Feb 2022

Is Microsoft Defender for Office 365 free? ›

Did you know you can try the features in Microsoft 365 Defender for Office 365 Plan 2 for free? Use the 90-day Defender for Office 365 trial at the Microsoft 365 Defender portal trials hub.

Does Office 365 have built in antivirus? ›

Microsoft Defender Antivirus is your next-generation protection. Office 365 includes antiphishing, antispam, and antimalware protection. With your Office 365 subscription, you get premium email and calendars, Office apps, 1 TB of cloud storage (via OneDrive), and advanced security across all your devices.

Does Microsoft 365 include ATP? ›

Microsoft Office 365 Advanced Threat Protection pricing

Microsoft includes ATP with its top-tier Office 365 Enterprise E5 subscription, but organizations can add the service to other Exchange and Office 365 subscriptions for $2 per user, per month.

What replaced Microsoft Defender? ›

Conversion to antivirus

Upon installation, Microsoft Security Essentials disabled and replaced Windows Defender. In Windows 8, Microsoft upgraded Windows Defender into an antivirus program very similar to Microsoft Security Essentials for Windows 7 and using the same virus definition updates.

What is the difference between Microsoft Defender and Windows Defender? ›

Formerly known as Windows Defender, Microsoft Defender is an antivirus protection program that's included with Windows 10. You can enable or disable Microsoft Defender at any time. There are third-party apps that are free or require a paid subscription that also offer antivirus services.

Videos

1. Microsoft Defender for Endpoint (MDATP) webinar: End-to-end security for your endpoints
(Microsoft Security Community)
2. Windows Defender ATP
(J)
3. Cyber Security With Windows Defender ATP
(G. Tech)
4. Microsoft Defender for Endpoint Overview
(Microsoft Security)
5. Microsoft Skills: Protecting Endpoints-Microsoft Defender Advanced Threat Protection Course Preview
(Pluralsight)
6. Threat Analytics in Microsoft Defender Advanced Threat Protection (ATP)
(Matt Soseman)
Top Articles
Latest Posts
Article information

Author: Aracelis Kilback

Last Updated: 02/20/2023

Views: 5896

Rating: 4.3 / 5 (44 voted)

Reviews: 83% of readers found this page helpful

Author information

Name: Aracelis Kilback

Birthday: 1994-11-22

Address: Apt. 895 30151 Green Plain, Lake Mariela, RI 98141

Phone: +5992291857476

Job: Legal Officer

Hobby: LARPing, role-playing games, Slacklining, Reading, Inline skating, Brazilian jiu-jitsu, Dance

Introduction: My name is Aracelis Kilback, I am a nice, gentle, agreeable, joyous, attractive, combative, gifted person who loves writing and wants to share my knowledge and understanding with you.