Microsoft Defender for Cloud Apps Deep Dive: Part 2 – Cloud Discovery and Shadow IT
How Microsoft Defender for Cloud Apps cloud discovery turns traffic logs into a risk-ranked view of Shadow IT: report types, log sources and processing.
Blog
Thoughts on security operations, threat hunting, and the daily life of a SOC analyst.
Microsoft Defender for Office 365 Part 14: Migrating to MDO from a Third-Party Secure Email Gateway
Migrating from a third-party SEG to MDO is not just a technical change - it is a security posture decision. Here is how to do it without dropping your guard at any point during the transition.
Microsoft Defender for Office 365 Part 13: Reporting & Monitoring - What to Watch and When to Act
Most teams open MDO reports after something goes wrong. This post is about using them to catch problems before they become incidents.
Microsoft Defender for Office 365 Part 12: SecOps Guide - Integrating MDO with Microsoft Defender XDR & Sentinel
Email threats rarely stay in email. Here is how MDO and Microsoft Defender XDR work together to give you the full picture.
Microsoft Defender for Office 365 Part 11: SecOps Guide - Incident Response with MDO
Knowing how MDO works is one thing - knowing how to operationalize it in a SOC is another. Here is the day-to-day incident response workflow every MDO security team needs.
No More Pivoting: Microsoft Defender Now Enriches Every IP, Domain, URL & File
Defender XDR now enriches IPs, domains, URLs & files with built-in threat intel - free for all customers. No extra tool needed.
Microsoft Defender for Office 365 Part 10: Attack Simulation Training
Security controls protect your technology - but what protects your users? Attack Simulation Training turns your workforce from a vulnerability into a line of defense.
Microsoft Defender for Office 365 Part 9: Automated Investigation & Response (AIR)
Every alert should trigger an investigation - but no security team has the capacity to manually investigate every alert. AIR closes that gap by automating the investigation and response process end to
The attackers didn't use a zero-day. They didn't need one. A patch had been sitting unused for 5 months - and nobody noticed.
A forensic breakdown of the Equifax kill chain - and the 4 Blue Team blueprints extracted from every point of failure.
Microsoft Defender for Office 365 Part 8: Threat Explorer & Real-Time Detection
Blocking threats is only half the job investigating them is the other half. Threat Explorer is where MDO's detection power meets your security team's investigative capability.
Microsoft Defender for Office 365 Part 7: Zero-Hour Auto Purge (ZAP) & Post-Delivery Protection
How Microsoft 365 automatically removes threats from inboxes after delivery - and what to do when malicious mail slips through.
Microsoft Defender for Office 365 Part 6: Safe Attachments & Safe Links
Malware signatures catch known threats - but what about zero-day attachments and URLs that turn malicious after delivery? Safe Attachments and Safe Links are how MDO closes that gap.
Microsoft Defender for Office 365 Part 5: Anti-Phishing & Impersonation Protection
Spam filters catch bulk threats - but phishing and impersonation attacks are surgical, targeted, and far more damaging. Here is how Microsoft Defender for Office 365 detects and stops them.
Microsoft Defender for Office 365 Part 4: Anti-Spam & Anti-Malware
Before layering advanced MDO features, the EOP baseline must be right. Anti-Spam and Anti-Malware are the first line of defense every email passes through - here's how to configure them correctly.
Microsoft Defender for Office 365 Part 3: Email Authentication Deep Dive
Spoofed emails can bypass even the best MDO policies. SPF, DKIM, DMARC, and ARC are the invisible foundation that makes everything else work - here's how to get them right.
Microsoft Defender for Office 365 Part 2: Deployment & Configuration Guide
Building on Part 1, this post focuses on deploying and configuring Microsoft Defender for Office 365 - getting your environment protected from day one.
Microsoft Defender for Endpoint Part 10: Threat Analytics & Intelligence
Stay ahead of emerging threats with Microsoft’s global threat intelligence understand active campaigns, leverage IOCs, and turn threat insights into proactive defenses.
Microsoft Defender for Endpoint Part 9.2: Vulnerability Management Operations
Master operational vulnerability management—analyze recommendations, hunt with KQL, prioritize remediation, and measure your security improvements effectively.
Microsoft Defender for Endpoint Part 9.1: Vulnerability Management Fundamentals
Discover vulnerabilities before attackers do learn how MDVM continuously assesses your environment and prioritizes what matters most.
Microsoft Defender for Endpoint Part 8: Next-Generation Protection
Leverage AI-powered threat detection, cloud intelligence, and behavioral analysis to stop zero-day attacks and sophisticated malware before they compromise your endpoints.
