Remediate Risks with Microsoft Defender for Office 365

By Ashwin Venugopal -

 



Microsoft Defender for Office 365

It is a cloud-based email filtering service that helps protect your organization against the unknown malware and viruses by providing a robust zero-day protection including the features to safeguard your organization from harmful links in real time. Microsoft Defender for Office 365 provides the following benefits:

  • Industry-leading protection- Microsoft Defender for Office 365 leverages 6.5 trillion signals daily from email alone to quickly and accurately detect threats as well as protect the users against the sophisticated attacks such as phishing and zero-day malware. 

  • Actionable insights- They are presented to the security administrators by correlating signals from a broad range of data to help identify, prioritize, and provide recommendations on how to address potential problems.

  • Automated response- Most organizations lack the expertise and resources needed for rapid investigation as well as effective remediation, but Microsoft Defender for Office 365 can easily provide advanced automated response options that the security operators can leverage saving a significant amount of time, money, and resources.

  • Training and awareness- It is critical to train end users to make the right decisions in the event of an attack and features like an attack simulator can help the administrators launch realistic threat simulations to train users to be more aware and vigilant. User reporting capabilities also empowers users to notify Microsoft of the suspicious content. 

The following are the primary ways you can use Microsoft Defender for Office 365 for message protection:

  • In the Microsoft Defender for Office 365 filtering-only scenario, it provides a cloud-based email protection for your on-premises Exchange Server environment or any other on-premises SMTP email solution.
  • Microsoft Defender for Office 365 can be enabled to protect Exchange Online cloud-hosted mailboxes. 
  • In a hybrid deployment, Microsoft Defender for Office 365 can be configured to protect messaging environment and control mail routing when you have a mix of on-premises as well as cloud mailboxes with Exchange Online Protection for inbound email filtering. 

Automate, Investigate, & Remediate (AIR)

AIR provides a set of the security playbooks that can be launched automatically, like when an alert is triggered, or manually, such as from a view in Explorer. It can also save your security operations team time as well as effort in mitigating threats effectively and efficiently. 

AIR in the Microsoft Defender for Office 365 includes certain remediation actions that include the following:

  • Soft delete email messages or clusters 
  • Block URL (time-of-click)
  • Turn off external mail forwarding
  • Turn off delegation 

Simulate Attacks

Microsoft Defender for Office 365 offers the best-of-class threat investigation and response tools that allows your organization's security team to anticipate,. understand, and prevent malicious attacks.
  • Threat trackers provides the latest intelligence on prevailing cybersecurity issues. Available trackers include Noteworthy trackers, Trending trackers, Tracked queries, and Saved queries.

  • Threat explorer (or real time detections) (also referred to as Explorer) is a real-time report that allows you to identify and analyze recent threats. You can configure Explorer to show data for custom periods. 

  • Attack simulator allows you to run realistic attack scenarios in your organization to identify vulnerabilities. Simulations of current types of attacks are available, including spear phishing, credential harvest, attachment attacks, password spray, and brute force password attacks. 

Threat explorer enables you to begin delving into the granular data for your organization. 

On the Users tab, you can see each instance that a user in the organization was sent with an attachment containing the Nemucod malware threat. The Status column tells you if the email was caught and blocked before it ever reach the user, or if it was delivered as spam and if a user have actually received and opened an email, that would also appear under Status, enabling you to reach out to the user as well as take appropriate remediation steps, such as scanning their device.





Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different groups of computers, re
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning of alert rule parameter
Read more

Design Planning (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Complex Organizational Structures SIEM can be an expensive security control, hence, it is common multiple businesses to contribute to the overall expense. Various organizational units may require a level of access to specific dashboards or sets of data. Microsoft Sentinel offers the ability to assign table-level permissions and limit the level of access to the minimum required to perform requisite job functions.  Role-based Access Control (RBAC) Requirements Microsoft Sentinel offers an extensive list of Azure built-in roles that can be used to provide granular access according to the job requirements and permitted level of access. Some of them are various Microsoft Sentinel dedicated roles: Microsoft Sentinel Contributor- Can perform all engineering-related configuration, such as creating alert rules, configuring data connectors, and additional similar tasks.  Microsoft Sentinel Reader- Can query the log data stor
Read more