defender-for-servers

Name: defender-for-servers
Author: vinayaklatthe

161stars34forks

How to install defender-for-servers?

vinayaklatthe/microsoft-security-skills/defender-for-servers

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-servers

Installs into the current project.

Summary

Guidance for Microsoft Defender for Servers (Plan 1 and Plan 2) — server-specific protection in Microsoft Defender for Cloud. Covers plan selection, agentless vs agent-based scanning, MDE for Servers integration, file integrity monitoring (FIM via MDE), just-in-time VM access, vu

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Servers
2
3	Defender for Servers is the server-focused plan inside Microsoft Defender for Cloud. It extends
4	Microsoft Defender for Endpoint (MDE) to Azure VMs, Azure Arc-enabled machines (on-prem,
5	AWS EC2, GCP Compute), and VM Scale Sets, and adds server-specific controls: just-in-time VM
6	access, file integrity monitoring, agentless disk scanning, and vulnerability assessment.
7
8	## When to use
9	Designing or hardening protection for server workloads — IaaS VMs, hybrid/multicloud
10	servers via Arc, jump hosts, domain controllers, line-of-business servers. Use this skill for
11	plan selection, MDE-for-Servers onboarding, FIM, JIT, and agentless vs agent-based scanning
12	trade-offs.
13
14	Do not use this skill for client endpoints (`defender-for-endpoint`), AKS/container hosts
15	(`defender-for-containers`), Azure storage accounts (`defender-for-storage`), or generic
16	Defender for Cloud posture (`defender-for-cloud-hardening`).
17
18	## Pick the plan
19
20	\| If you need... \| Plan \|
21	\|---\|---\|
22	\| Free foundational CSPM only (no server EDR) \| Defender CSPM (no server plan) \|
23	\| MDE Plan 2 EDR, threat detection, free 500 MB/day Log Analytics ingestion \| Defender for Servers Plan 1 (per-server) \|
24	\| Everything in P1 plus FIM, JIT, agentless scanning, vuln assessment, adaptive app controls, network hardening, regulatory compliance, 500 MB free ingestion \| Defender for Servers Plan 2 \|
25
26	> Rule of thumb: Plan 1 = "I just need EDR everywhere." Plan 2 = "I need EDR + posture +
27	> compliance + FIM." Most enterprises pick P2 for production, P1 for dev/test.
28
29	## Onboarding paths
30
31	\| Estate \| Path \|
32	\|---\|---\|
33	\| Azure VMs \| Enable plan at subscription scope; auto-provisioning deploys MDE + Azure Monitor Agent \|
34	\| On-prem / VMware servers \| Azure Arc onboarding, then enable plan \|
35	\| AWS EC2 / GCP Compute \| Connect AWS account / GCP project to Defender for Cloud; auto-provisioning via Arc \|
36	\| VMSS (uniform) \| Plan applies; agentless scan covers ephemeral instances \|
37
38	## Approach
39
40	1. Inventory and connect first. Onboard non-Azure servers via Arc before enabling the
41	plan; otherwise you pay per-server but get no coverage on hybrid estate.
42	*Verify: Defender for Cloud → Inventory shows all expected resources with a Defender plan
43	column = Plan 1/2.*
44
45	2. Enable Plan 2 at subscription scope (not resource group) so new VMs inherit
46	automatically. Use Azure Policy Configure Microsoft Defender for Servers to be enabled
47	at the management group for multi-sub estates.
48
49	3. Turn on auto-provisioning of MDE integration. This pushes the MDE sensor via the
50	unified solution; do not also onboard servers directly through Intune or local script —
51	it causes telemetry duplication and double billing.
52	Verify: a sample VM appears in security.microsoft.com → Device inventory within 1 hour.
53
54	4. Enable agentless disk scanning. Reads VM disk snapshots to find malware, secrets, and
55	vulnerabilities without any agent — runs once per 24h, no performance impact.
56	*Verify: Recommendations → "Machines should have a vulnerability assessment solution" green
57	for VMs without MDE Vulnerability Management agent.*
58
59	5. Configure JIT VM access for any VM with management ports (RDP 3389, SSH 22, WinRM
60	5985/5986). Default to 3-hour max request, source IP = requestor only.
61	*Verify: NSGs show JIT-managed deny rules for the protected ports; access requests show in
62	activity log.*
63
64	6. File Integrity Monitoring via MDE (the Log Analytics-based FIM is being retired).
65	Enable on tier-0 servers (DCs, PKI, jump hosts) first. Tune the rule set — default
66	includes Windows system files; add your app's config paths.
67	*Verify: FIM events appear in MDE advanced hunting `DeviceFileEvents` with
68	ActionType = FileCreated/Modified on the monitored paths.*

People who liked this also viewed

6 picks

Type

defender-for-servers

161stars34forks

View on GitHub

How to install defender-for-servers?

vinayaklatthe/microsoft-security-skills/defender-for-servers

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-servers

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Servers
2
3	Defender for Servers is the server-focused plan inside Microsoft Defender for Cloud. It extends
4	Microsoft Defender for Endpoint (MDE) to Azure VMs, Azure Arc-enabled machines (on-prem,
5	AWS EC2, GCP Compute), and VM Scale Sets, and adds server-specific controls: just-in-time VM
6	access, file integrity monitoring, agentless disk scanning, and vulnerability assessment.
7
8	## When to use
9	Designing or hardening protection for server workloads — IaaS VMs, hybrid/multicloud
10	servers via Arc, jump hosts, domain controllers, line-of-business servers. Use this skill for
11	plan selection, MDE-for-Servers onboarding, FIM, JIT, and agentless vs agent-based scanning
12	trade-offs.
13
14	Do not use this skill for client endpoints (`defender-for-endpoint`), AKS/container hosts
15	(`defender-for-containers`), Azure storage accounts (`defender-for-storage`), or generic
16	Defender for Cloud posture (`defender-for-cloud-hardening`).
17
18	## Pick the plan
19
20	\| If you need... \| Plan \|
21	\|---\|---\|
22	\| Free foundational CSPM only (no server EDR) \| Defender CSPM (no server plan) \|
23	\| MDE Plan 2 EDR, threat detection, free 500 MB/day Log Analytics ingestion \| Defender for Servers Plan 1 (per-server) \|
24	\| Everything in P1 plus FIM, JIT, agentless scanning, vuln assessment, adaptive app controls, network hardening, regulatory compliance, 500 MB free ingestion \| Defender for Servers Plan 2 \|
25
26	> Rule of thumb: Plan 1 = "I just need EDR everywhere." Plan 2 = "I need EDR + posture +
27	> compliance + FIM." Most enterprises pick P2 for production, P1 for dev/test.
28
29	## Onboarding paths
30
31	\| Estate \| Path \|
32	\|---\|---\|
33	\| Azure VMs \| Enable plan at subscription scope; auto-provisioning deploys MDE + Azure Monitor Agent \|
34	\| On-prem / VMware servers \| Azure Arc onboarding, then enable plan \|
35	\| AWS EC2 / GCP Compute \| Connect AWS account / GCP project to Defender for Cloud; auto-provisioning via Arc \|
36	\| VMSS (uniform) \| Plan applies; agentless scan covers ephemeral instances \|
37
38	## Approach
39
40	1. Inventory and connect first. Onboard non-Azure servers via Arc before enabling the
41	plan; otherwise you pay per-server but get no coverage on hybrid estate.
42	*Verify: Defender for Cloud → Inventory shows all expected resources with a Defender plan
43	column = Plan 1/2.*
44
45	2. Enable Plan 2 at subscription scope (not resource group) so new VMs inherit
46	automatically. Use Azure Policy Configure Microsoft Defender for Servers to be enabled
47	at the management group for multi-sub estates.
48
49	3. Turn on auto-provisioning of MDE integration. This pushes the MDE sensor via the
50	unified solution; do not also onboard servers directly through Intune or local script —
51	it causes telemetry duplication and double billing.
52	Verify: a sample VM appears in security.microsoft.com → Device inventory within 1 hour.
53
54	4. Enable agentless disk scanning. Reads VM disk snapshots to find malware, secrets, and
55	vulnerabilities without any agent — runs once per 24h, no performance impact.
56	*Verify: Recommendations → "Machines should have a vulnerability assessment solution" green
57	for VMs without MDE Vulnerability Management agent.*
58
59	5. Configure JIT VM access for any VM with management ports (RDP 3389, SSH 22, WinRM
60	5985/5986). Default to 3-hour max request, source IP = requestor only.
61	*Verify: NSGs show JIT-managed deny rules for the protected ports; access requests show in
62	activity log.*
63
64	6. File Integrity Monitoring via MDE (the Log Analytics-based FIM is being retired).
65	Enable on tier-0 servers (DCs, PKI, jump hosts) first. Tune the rule set — default
66	includes Windows system files; add your app's config paths.
67	*Verify: FIM events appear in MDE advanced hunting `DeviceFileEvents` with
68	ActionType = FileCreated/Modified on the monitored paths.*

People who liked this also viewed

6 picks

Type