defender-easm

Name: defender-easm
Author: vinayaklatthe

161stars34forks

How to install defender-easm?

vinayaklatthe/microsoft-security-skills/defender-easm

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-easm

Installs into the current project.

Summary

Guidance for Microsoft Defender External Attack Surface Management (Defender EASM) — discovers and inventories an organization's internet-facing assets (domains, hosts, IPs, SSL certs, ASNs, web pages, contacts) from the outside-in. Covers seed-based discovery, attack surface ins

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender EASM
2
3	Defender External Attack Surface Management (EASM) builds and maintains a continuous,
4	outside-in inventory of an organization's internet-facing footprint and surfaces risks
5	on those assets — expired SSL certs, exposed admin interfaces, end-of-life web tech, and
6	known CVEs — without any agent or credentials.
7
8	## When to use
9	- You don't have a complete list of internet-facing assets (most orgs don't).
10	- M&A: rapid discovery of an acquired company's internet footprint before integration.
11	- Subsidiary / shadow IT discovery — assets registered to anyone, deployed anywhere.
12	- Continuous monitoring of certificate expiration, exposed services, deprecated software.
13
14	Do not use this skill for internal asset posture (`defender-for-cloud-hardening`),
15	endpoint vulnerability management (`defender-for-endpoint`), or generic SOC hunting
16	(`sentinel-detection-engineering`).
17
18	## How discovery works
19
20	EASM starts from seeds — known domains, IPs, ASNs, contacts (WHOIS), or organization
21	names — and walks outward through DNS, WHOIS, certificate transparency logs, ASN data, and
22	web crawling to discover related assets. Findings are placed in:
23
24	\| State \| Meaning \|
25	\|---\|---\|
26	\| Approved Inventory \| Confirmed yours; counts toward pricing \|
27	\| Candidate \| Discovered but unconfirmed; review and approve/dismiss \|
28	\| Dependency \| Used by your assets but not owned (CDN, third-party API) \|
29	\| Monitor Only \| Tracked but not yours (e.g., a partner) \|
30
31	> Rule of thumb: Start with 5–10 high-confidence seeds. Trust the discovery chain;
32	> don't try to add every domain manually — you'll miss the unknown unknowns.
33
34	## Approach
35
36	1. Seed selection. Start with primary brand domains, top-2 ASN numbers, and a few key
37	email-domain WHOIS contacts. Avoid generic CDN domains as seeds (massive false
38	positives).
39
40	2. Initial discovery run (24–72 hours). Review Candidates weekly for the first
41	month. Approve real ones; dismiss false positives with a reason (used to refine
42	discovery).
43
44	3. Label and group. Tag assets by business unit, region, criticality. Without labels,
45	risk views are unactionable.
46
47	4. Attack surface insights — fix high-impact first.
48	Priority order:
49	1. Exposed sensitive services (RDP/3389, SMB/445, database ports) on internet IPs.
50	2. Expired or expiring SSL certs within 30 days.
51	3. End-of-life software (Apache 2.2, IIS 7, OpenSSL 1.0).
52	4. High/critical CVEs with known exploits on identified versions.
53	5. Unsanctioned cloud — assets in a CSP not in your approved list.
54
55	5. Integrate with the rest of the portfolio.
56	- Defender for Cloud (CSPM) — EASM-discovered Azure assets correlate to Azure
57	resources for full inside+outside view.
58	- Defender XDR — exposed assets appear under attack-surface insights.
59	- Sentinel — pull EASM data via REST API into a watchlist for hunting (e.g.,
60	"alert if outbound C2 destination matches an EASM-known dependency owned by us").
61
62	6. M&A workflow. Add target-company seeds during diligence; export the candidate list
63	as a tracked risk register for integration. Don't approve into inventory until close.
64
65	7. Re-baseline quarterly. Brand consolidation, decommissioned subs, divested BUs all
66	change the seed list.
67
68	## Guardrails
69	- Approve carefully — every approval = billed asset. Treat dismiss-with-reason as
70	important as approve; refines future discovery and controls cost.
71	- Pricing is per asset/month with a generous monthly free tier; understand the meter
72	before mass-approving CDN dependencies.
73	- EASM is detection, not response. It tells you the exposed RDP exists; closing the
74	port is a network/firewall change you must make elsewhere.
75	- Do not seed competitor domains "to compare." Discovery walks aggressively; you'll
76	create attribution noise.
77	- Don't expect zero-day vuln detection. EASM matches versions to known CVEs from

People who liked this also viewed

6 picks

Type

defender-easm

161stars34forks

View on GitHub

How to install defender-easm?

vinayaklatthe/microsoft-security-skills/defender-easm

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-easm

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender EASM
2
3	Defender External Attack Surface Management (EASM) builds and maintains a continuous,
4	outside-in inventory of an organization's internet-facing footprint and surfaces risks
5	on those assets — expired SSL certs, exposed admin interfaces, end-of-life web tech, and
6	known CVEs — without any agent or credentials.
7
8	## When to use
9	- You don't have a complete list of internet-facing assets (most orgs don't).
10	- M&A: rapid discovery of an acquired company's internet footprint before integration.
11	- Subsidiary / shadow IT discovery — assets registered to anyone, deployed anywhere.
12	- Continuous monitoring of certificate expiration, exposed services, deprecated software.
13
14	Do not use this skill for internal asset posture (`defender-for-cloud-hardening`),
15	endpoint vulnerability management (`defender-for-endpoint`), or generic SOC hunting
16	(`sentinel-detection-engineering`).
17
18	## How discovery works
19
20	EASM starts from seeds — known domains, IPs, ASNs, contacts (WHOIS), or organization
21	names — and walks outward through DNS, WHOIS, certificate transparency logs, ASN data, and
22	web crawling to discover related assets. Findings are placed in:
23
24	\| State \| Meaning \|
25	\|---\|---\|
26	\| Approved Inventory \| Confirmed yours; counts toward pricing \|
27	\| Candidate \| Discovered but unconfirmed; review and approve/dismiss \|
28	\| Dependency \| Used by your assets but not owned (CDN, third-party API) \|
29	\| Monitor Only \| Tracked but not yours (e.g., a partner) \|
30
31	> Rule of thumb: Start with 5–10 high-confidence seeds. Trust the discovery chain;
32	> don't try to add every domain manually — you'll miss the unknown unknowns.
33
34	## Approach
35
36	1. Seed selection. Start with primary brand domains, top-2 ASN numbers, and a few key
37	email-domain WHOIS contacts. Avoid generic CDN domains as seeds (massive false
38	positives).
39
40	2. Initial discovery run (24–72 hours). Review Candidates weekly for the first
41	month. Approve real ones; dismiss false positives with a reason (used to refine
42	discovery).
43
44	3. Label and group. Tag assets by business unit, region, criticality. Without labels,
45	risk views are unactionable.
46
47	4. Attack surface insights — fix high-impact first.
48	Priority order:
49	1. Exposed sensitive services (RDP/3389, SMB/445, database ports) on internet IPs.
50	2. Expired or expiring SSL certs within 30 days.
51	3. End-of-life software (Apache 2.2, IIS 7, OpenSSL 1.0).
52	4. High/critical CVEs with known exploits on identified versions.
53	5. Unsanctioned cloud — assets in a CSP not in your approved list.
54
55	5. Integrate with the rest of the portfolio.
56	- Defender for Cloud (CSPM) — EASM-discovered Azure assets correlate to Azure
57	resources for full inside+outside view.
58	- Defender XDR — exposed assets appear under attack-surface insights.
59	- Sentinel — pull EASM data via REST API into a watchlist for hunting (e.g.,
60	"alert if outbound C2 destination matches an EASM-known dependency owned by us").
61
62	6. M&A workflow. Add target-company seeds during diligence; export the candidate list
63	as a tracked risk register for integration. Don't approve into inventory until close.
64
65	7. Re-baseline quarterly. Brand consolidation, decommissioned subs, divested BUs all
66	change the seed list.
67
68	## Guardrails
69	- Approve carefully — every approval = billed asset. Treat dismiss-with-reason as
70	important as approve; refines future discovery and controls cost.
71	- Pricing is per asset/month with a generous monthly free tier; understand the meter
72	before mass-approving CDN dependencies.
73	- EASM is detection, not response. It tells you the exposed RDP exists; closing the
74	port is a network/firewall change you must make elsewhere.
75	- Do not seed competitor domains "to compare." Discovery walks aggressively; you'll
76	create attribution noise.
77	- Don't expect zero-day vuln detection. EASM matches versions to known CVEs from

People who liked this also viewed

6 picks

Type