defender-tvm

Name: defender-tvm
Author: vinayaklatthe

161stars34forks

How to install defender-tvm?

vinayaklatthe/microsoft-security-skills/defender-tvm

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-tvm

Installs into the current project.

Summary

Guidance for Microsoft Defender Threat Intelligence (Defender TI) and Microsoft Defender Vulnerability Management (MDVM) — the threat-and-vulnerability layer of Defender XDR. Covers MDVM exposure score, CVE prioritization with threat insights and active campaigns, security baseli

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender TI & Vulnerability Management
2
3	This skill covers two complementary capabilities:
4
5	- Microsoft Defender Vulnerability Management (MDVM) — risk-based vulnerability
6	management for endpoints (Windows, macOS, Linux, mobile), firmware, browser extensions,
7	certificates, and security baselines.
8	- Microsoft Defender Threat Intelligence (Defender TI / MDTI) — Microsoft's
9	finished-intel and raw-IOC product for adversary tracking, infrastructure pivoting, and
10	threat hunting enrichment.
11
12	Both feed Defender XDR and Sentinel.
13
14	## When to use
15	- Prioritizing patching/remediation across a large endpoint estate.
16	- Measuring exposure score and security baseline drift.
17	- Hunting and responding to threats with adversary intel and infrastructure data.
18	- Enriching SIEM alerts with intel profiles and indicator context.
19
20	Do not use this skill for endpoint policy/onboarding (`defender-for-endpoint`), SIEM
21	detection rules (`sentinel-detection-engineering`), or outside-in attack surface
22	(`defender-easm`).
23
24	## MDVM — what's in core MDE Plan 2 vs the add-on
25
26	\| Capability \| MDE Plan 2 \| MDVM Add-on \|
27	\|---\|---\|---\|
28	\| CVE-based vulnerability inventory \| ✅ \| ✅ \|
29	\| Exposure score, recommendations \| ✅ \| ✅ \|
30	\| Threat-aware prioritization \| ✅ \| ✅ \|
31	\| Security baselines assessment (CIS, STIG) \| — \| ✅ \|
32	\| Browser extension inventory \| — \| ✅ \|
33	\| Digital certificate inventory \| — \| ✅ \|
34	\| Network share configuration assessment \| — \| ✅ \|
35	\| Hardware & firmware inventory \| — \| ✅ \|
36	\| Block vulnerable applications \| — \| ✅ \|
37	\| Authenticated scan for unmanaged Windows \| — \| ✅ \|
38
39	> Rule of thumb: If you're already on MDE P2 and your audit team asks for CIS-aligned
40	> evidence, you need the MDVM add-on.
41
42	## Approach
43
44	### MDVM workflow
45
46	1. Triage by exposure score, not CVE count. Exposure score weights
47	exploitability + asset criticality + active threat campaigns. A 5,000-CVE backlog
48	sorted by exposure becomes a 50-task action list.
49
50	2. Use threat insights filters. Microsoft tags CVEs with: Public Exploit,
51	Verified by Microsoft, Active Threat Campaign, Exploit Available in Kit. Patch
52	Active Threat Campaign first, regardless of CVSS.
53
54	3. Wire remediation to Intune. "Create remediation request" pushes a task to Intune
55	admin queue with the affected device list — the patch lifecycle stays in one place.
56
57	4. Security baselines (Plan 2 add-on). Pick CIS or STIG, scope to a device group,
58	review compliance per setting, prioritize the security-impacting settings.
59
60	5. Block vulnerable apps (add-on). Use sparingly: blocks Adobe Reader 21.x,
61	Chrome <120, etc. across the estate. Pilot on a small group; some users have
62	legitimate version pins.
63
64	6. Cadence. Weekly review of top-10 exposure-reducing actions; monthly executive
65	exposure-score trend; quarterly baseline drift report.
66
67	### Defender TI workflow
68
69	1. Intel profiles — track named adversaries (e.g., Storm-####), threat tools, CVEs,
70	campaigns. Subscribe relevant ones; updates surface in Defender XDR.
71
72	2. Infrastructure pivoting. Given an indicator (IP, domain, hash), Defender TI shows
73	pDNS, WHOIS history, certificate associations, related infrastructure — pivot to find
74	adversary infrastructure your SIEM hasn't seen yet.
75
76	3. Bring intel into hunting.
77	- Defender XDR advanced hunting: indicators are first-class joinable entities.
78	- Sentinel: connect MDTI via the Threat Intelligence Premium data connector;
79	`ThreatIntelligenceIndicator` and articles populate.
80
81	4. MDTI API for automation. Pull articles/indicators into a SOAR playbook for
82	auto-enrichment of incidents.
83
84	5. Free vs Premium. Defender TI portal has a free tier (limited articles,
85	pivots/day); Premium unlocks unlimited pivots, full intel-

People who liked this also viewed

6 picks

Type

defender-tvm

161stars34forks

View on GitHub

How to install defender-tvm?

vinayaklatthe/microsoft-security-skills/defender-tvm

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-tvm

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender TI & Vulnerability Management
2
3	This skill covers two complementary capabilities:
4
5	- Microsoft Defender Vulnerability Management (MDVM) — risk-based vulnerability
6	management for endpoints (Windows, macOS, Linux, mobile), firmware, browser extensions,
7	certificates, and security baselines.
8	- Microsoft Defender Threat Intelligence (Defender TI / MDTI) — Microsoft's
9	finished-intel and raw-IOC product for adversary tracking, infrastructure pivoting, and
10	threat hunting enrichment.
11
12	Both feed Defender XDR and Sentinel.
13
14	## When to use
15	- Prioritizing patching/remediation across a large endpoint estate.
16	- Measuring exposure score and security baseline drift.
17	- Hunting and responding to threats with adversary intel and infrastructure data.
18	- Enriching SIEM alerts with intel profiles and indicator context.
19
20	Do not use this skill for endpoint policy/onboarding (`defender-for-endpoint`), SIEM
21	detection rules (`sentinel-detection-engineering`), or outside-in attack surface
22	(`defender-easm`).
23
24	## MDVM — what's in core MDE Plan 2 vs the add-on
25
26	\| Capability \| MDE Plan 2 \| MDVM Add-on \|
27	\|---\|---\|---\|
28	\| CVE-based vulnerability inventory \| ✅ \| ✅ \|
29	\| Exposure score, recommendations \| ✅ \| ✅ \|
30	\| Threat-aware prioritization \| ✅ \| ✅ \|
31	\| Security baselines assessment (CIS, STIG) \| — \| ✅ \|
32	\| Browser extension inventory \| — \| ✅ \|
33	\| Digital certificate inventory \| — \| ✅ \|
34	\| Network share configuration assessment \| — \| ✅ \|
35	\| Hardware & firmware inventory \| — \| ✅ \|
36	\| Block vulnerable applications \| — \| ✅ \|
37	\| Authenticated scan for unmanaged Windows \| — \| ✅ \|
38
39	> Rule of thumb: If you're already on MDE P2 and your audit team asks for CIS-aligned
40	> evidence, you need the MDVM add-on.
41
42	## Approach
43
44	### MDVM workflow
45
46	1. Triage by exposure score, not CVE count. Exposure score weights
47	exploitability + asset criticality + active threat campaigns. A 5,000-CVE backlog
48	sorted by exposure becomes a 50-task action list.
49
50	2. Use threat insights filters. Microsoft tags CVEs with: Public Exploit,
51	Verified by Microsoft, Active Threat Campaign, Exploit Available in Kit. Patch
52	Active Threat Campaign first, regardless of CVSS.
53
54	3. Wire remediation to Intune. "Create remediation request" pushes a task to Intune
55	admin queue with the affected device list — the patch lifecycle stays in one place.
56
57	4. Security baselines (Plan 2 add-on). Pick CIS or STIG, scope to a device group,
58	review compliance per setting, prioritize the security-impacting settings.
59
60	5. Block vulnerable apps (add-on). Use sparingly: blocks Adobe Reader 21.x,
61	Chrome <120, etc. across the estate. Pilot on a small group; some users have
62	legitimate version pins.
63
64	6. Cadence. Weekly review of top-10 exposure-reducing actions; monthly executive
65	exposure-score trend; quarterly baseline drift report.
66
67	### Defender TI workflow
68
69	1. Intel profiles — track named adversaries (e.g., Storm-####), threat tools, CVEs,
70	campaigns. Subscribe relevant ones; updates surface in Defender XDR.
71
72	2. Infrastructure pivoting. Given an indicator (IP, domain, hash), Defender TI shows
73	pDNS, WHOIS history, certificate associations, related infrastructure — pivot to find
74	adversary infrastructure your SIEM hasn't seen yet.
75
76	3. Bring intel into hunting.
77	- Defender XDR advanced hunting: indicators are first-class joinable entities.
78	- Sentinel: connect MDTI via the Threat Intelligence Premium data connector;
79	`ThreatIntelligenceIndicator` and articles populate.
80
81	4. MDTI API for automation. Pull articles/indicators into a SOAR playbook for
82	auto-enrichment of incidents.
83
84	5. Free vs Premium. Defender TI portal has a free tier (limited articles,
85	pivots/day); Premium unlocks unlimited pivots, full intel-

People who liked this also viewed

6 picks

Type