defender-for-endpoint

Name: defender-for-endpoint
Author: vinayaklatthe

60installs34forks

How to install defender-for-endpoint?

vinayaklatthe/microsoft-security-skills/defender-for-endpoint

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-endpoint

Installs into the current project.

Summary

Guidance for Microsoft Defender for Endpoint (MDE) — enterprise endpoint security with next-gen AV, EDR, attack surface reduction (ASR), Defender Vulnerability Management, automated investigation and remediation (AIR), and live response. Covers Plan 1 vs Plan 2 selection, onboard

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Endpoint
2
3	Microsoft Defender for Endpoint (MDE) is the enterprise endpoint security platform providing
4	prevention (next-gen AV, ASR), detection and response (EDR), threat & vulnerability management
5	(Defender Vulnerability Management), and automated investigation and remediation (AIR). It
6	feeds the endpoint pillar of Defender XDR.
7
8	## When to use
9	Protecting Windows, macOS, Linux, iOS, and Android endpoints. This is the right skill for
10	onboarding decisions, policy design, ASR rollout, EDR tuning, and response action scoping.
11
12	Do not use this skill for cross-workload investigation (`defender-xdr`), Azure resource
13	hardening (`defender-for-cloud-hardening`), or identity-side detection (`defender-for-identity`).
14
15	## Pick the plan and the onboarding path
16
17	\| If you need... \| Plan / SKU \| Notes \|
18	\|---\|---\|---\|
19	\| Next-gen AV, ASR, web/network protection, manual response \| MDE Plan 1 \| Bundled with M365 E3 since 2022 \|
20	\| EDR, AIR, advanced hunting, custom detections, Threat & Vuln Management \| MDE Plan 2 \| Bundled with M365 E5 / MDE P2 \|
21	\| Full vulnerability remediation workflows, browser extension assessments \| Defender Vulnerability Management add-on \| Adds to P2 \|
22	\| Server endpoints (Windows / Linux) \| MDE for Servers via Defender for Cloud \| Per-server billing, includes MDE P2 \|
23
24	\| Estate \| Preferred onboarding path \|
25	\|---\|---\|
26	\| Cloud-managed Windows (Intune-managed) \| Intune + Security Settings Management \|
27	\| Co-managed (MECM + Intune) \| Configuration Manager workload slider, then move to Intune \|
28	\| AD-joined only, no MDM \| GPO onboarding script \|
29	\| Server (Windows/Linux) \| Defender for Cloud auto-provisioning \|
30	\| macOS / Linux workstations \| Intune with MDM enrollment \|
31	\| Air-gapped / one-off \| Local script (90-day expiry) \|
32
33	> Rule of thumb: if a device exists in Intune, onboard via Intune Security Settings
34	> Management - one place to manage AV + ASR + EDR. GPO is the legacy fallback, not the
35	> default for new builds.
36
37	## Approach
38
39	1. Confirm plan + estate inventory — Inventory devices by OS, management state, and current
40	AV. Map to plan/onboarding path table above.
41	*Verify: `Get-MpComputerStatus` on a sample Win11 device shows AMServiceEnabled = True;
42	Intune shows the device as compliant.*
43
44	2. Enable tamper protection everywhere first — Before any other policy. Without it,
45	attackers (and well-meaning admins) can disable everything else.
46	*Verify: device shows tamper protection On in security.microsoft.com → Settings → Endpoints
47	→ Advanced features.*
48
49	3. Onboard in waves — 100 pilot devices for 7 days, then a representative wave (1,000 or
50	10% of estate), then the rest. Watch the Device inventory for stuck devices (Last seen
51	> 24h after onboarding).
52	Verify: device count in MDE matches Intune device count within 5%.
53
54	4. Next-gen AV policy — Real-time protection on, cloud-delivered protection on (High
55	block level for high-risk groups), PUA blocking in audit then block, tamper protection on,
56	network protection in block, controlled folder access in audit (then block on user
57	workstations only - servers break).
58	*Verify: Defender configuration management report shows green on these toggles for the pilot
59	group.*
60
61	5. ASR rules - audit, measure, block — Enable all rules in audit for 14 days. Use the
62	ASR rules report to see which rules would have blocked what. Move noisy rules to a tighter
63	scope (e.g. exclude line-of-business apps), then block the rest.
64	*Verify: ASR rules report shows zero blocks for known-good apps in audit; promote to block
65	one rule per week.*
66
67	6. EDR in block mode — Enable even if Defender AV is primary. If a non-Microsoft AV is
68	primary, EDR in block mode is mandatory - it's the only way EDR detections result in
69	automatic remediation

People who liked this also viewed

6 picks

Type

defender-for-endpoint

60installs34forks

View on GitHub

How to install defender-for-endpoint?

vinayaklatthe/microsoft-security-skills/defender-for-endpoint

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-endpoint

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Endpoint
2
3	Microsoft Defender for Endpoint (MDE) is the enterprise endpoint security platform providing
4	prevention (next-gen AV, ASR), detection and response (EDR), threat & vulnerability management
5	(Defender Vulnerability Management), and automated investigation and remediation (AIR). It
6	feeds the endpoint pillar of Defender XDR.
7
8	## When to use
9	Protecting Windows, macOS, Linux, iOS, and Android endpoints. This is the right skill for
10	onboarding decisions, policy design, ASR rollout, EDR tuning, and response action scoping.
11
12	Do not use this skill for cross-workload investigation (`defender-xdr`), Azure resource
13	hardening (`defender-for-cloud-hardening`), or identity-side detection (`defender-for-identity`).
14
15	## Pick the plan and the onboarding path
16
17	\| If you need... \| Plan / SKU \| Notes \|
18	\|---\|---\|---\|
19	\| Next-gen AV, ASR, web/network protection, manual response \| MDE Plan 1 \| Bundled with M365 E3 since 2022 \|
20	\| EDR, AIR, advanced hunting, custom detections, Threat & Vuln Management \| MDE Plan 2 \| Bundled with M365 E5 / MDE P2 \|
21	\| Full vulnerability remediation workflows, browser extension assessments \| Defender Vulnerability Management add-on \| Adds to P2 \|
22	\| Server endpoints (Windows / Linux) \| MDE for Servers via Defender for Cloud \| Per-server billing, includes MDE P2 \|
23
24	\| Estate \| Preferred onboarding path \|
25	\|---\|---\|
26	\| Cloud-managed Windows (Intune-managed) \| Intune + Security Settings Management \|
27	\| Co-managed (MECM + Intune) \| Configuration Manager workload slider, then move to Intune \|
28	\| AD-joined only, no MDM \| GPO onboarding script \|
29	\| Server (Windows/Linux) \| Defender for Cloud auto-provisioning \|
30	\| macOS / Linux workstations \| Intune with MDM enrollment \|
31	\| Air-gapped / one-off \| Local script (90-day expiry) \|
32
33	> Rule of thumb: if a device exists in Intune, onboard via Intune Security Settings
34	> Management - one place to manage AV + ASR + EDR. GPO is the legacy fallback, not the
35	> default for new builds.
36
37	## Approach
38
39	1. Confirm plan + estate inventory — Inventory devices by OS, management state, and current
40	AV. Map to plan/onboarding path table above.
41	*Verify: `Get-MpComputerStatus` on a sample Win11 device shows AMServiceEnabled = True;
42	Intune shows the device as compliant.*
43
44	2. Enable tamper protection everywhere first — Before any other policy. Without it,
45	attackers (and well-meaning admins) can disable everything else.
46	*Verify: device shows tamper protection On in security.microsoft.com → Settings → Endpoints
47	→ Advanced features.*
48
49	3. Onboard in waves — 100 pilot devices for 7 days, then a representative wave (1,000 or
50	10% of estate), then the rest. Watch the Device inventory for stuck devices (Last seen
51	> 24h after onboarding).
52	Verify: device count in MDE matches Intune device count within 5%.
53
54	4. Next-gen AV policy — Real-time protection on, cloud-delivered protection on (High
55	block level for high-risk groups), PUA blocking in audit then block, tamper protection on,
56	network protection in block, controlled folder access in audit (then block on user
57	workstations only - servers break).
58	*Verify: Defender configuration management report shows green on these toggles for the pilot
59	group.*
60
61	5. ASR rules - audit, measure, block — Enable all rules in audit for 14 days. Use the
62	ASR rules report to see which rules would have blocked what. Move noisy rules to a tighter
63	scope (e.g. exclude line-of-business apps), then block the rest.
64	*Verify: ASR rules report shows zero blocks for known-good apps in audit; promote to block
65	one rule per week.*
66
67	6. EDR in block mode — Enable even if Defender AV is primary. If a non-Microsoft AV is
68	primary, EDR in block mode is mandatory - it's the only way EDR detections result in
69	automatic remediation

People who liked this also viewed

6 picks

Type