Course Overview
This course provides a comprehensive overview of Microsoft Defender for Endpoint, part of the broader Microsoft Defender Products Security Portfolio. The training will cover various aspects of endpoint protection, including cloud app security, identity protection, threat detection, and response capabilities. Participants will gain hands-on experience with deploying, managing, and optimizing Microsoft Defender for Endpoint solutions to protect their organization’s devices and sensitive data against modern threats.
Course Objective
By the end of the course, participants will be able to:
- Understand the key components and architecture of Microsoft Defender for Endpoint.
- Deploy and configure Microsoft Defender for Endpoint across different platforms.
- Implement advanced security policies to enhance endpoint protection.
- Perform threat detection, investigation, and response using Defender’s advanced tools.
- Integrate Microsoft Defender for Endpoint with other Microsoft security services, such as Microsoft Defender for Identity and Cloud Apps.
- Monitor, analyze, and respond to security alerts in real-time, enhancing the organization’s overall cybersecurity posture.
Pre-requisites
- Basic understanding of cybersecurity principles.
- Familiarity with Windows and Linux operating systems.
- Experience with cloud-based security tools is a plus but not required.
- Knowledge of Microsoft 365 and Azure environments will be beneficial.
Course Curriculum
- Microsoft Defender for Cloud Apps
- Microsoft Defender for M365
- Microsoft Defender for Identity
- Microsoft Defender for CWPP
- Microsoft Defender for CSPM
- Microsoft Defender for EndPoint
- Microsoft Defender for Vulnerability Management
- Microsoft Defender for EASM
- Microsoft Defender XDR – High Level Overview
- Product Overview & Use Cases
- Key Features & Capabilities
- Architecture & Building Blocks
- Support Matrix & Deployment Pre-requisites
- Microsoft Defender for Endpoint Plans
- System Requirements
- Installation and Deployment
- Endpoint Onboarding Methods
- Demo – Onboarding Endpoints using Local Script (On-Premise VMs)
- Demo – Onboarding Endpoints using Microsoft Defender for Cloud (Cloud VMs)
- Designing MDE for a Large Organization (Including Hybrid Scenarios)
- MDE Dashboard Overview
- MDE Portal Settings Configuration
- Indicators of Compromise (IoC) – Hash, URL & Certificate
- Malware Protection (Next Generation Protection)
- Endpoint Detection and Response (EDR)
- Core Defender Endpoint Vulnerability Management
- Attack Surface Reduction
- Automated Investigation & Remediation
- Microsoft Threat Experts
- Event, Alerts & Incident Investigation
- Automated Investigation & Response
- Threat Hunting
- Custom Detection Rules (KQL)
- Alert Suppression
- Configuring Security Policies
- Customizing Settings for Specific Needs
- Integration with Microsoft Defender for Cloud
- Integration with Microsoft Sentinel
- Integration with Microsoft Defender for Cloud Apps
- Integration with Microsoft Defender for Identity
- MDE in Microsoft Defender XDR – High Level Overview
- Third-Party Integrations
- Monitoring Security Incidents
- Reporting & Analytics
- Best Practices for Optimizing Security
- Performance Tuning
- Common Issues and Resolutions
- Support & Community Resources
