Microsoft Defender for Endpoint

Should we automatically isolate servers and high-value devices after high-confidence detections?

We don't have a 24/7 SOC, so we're considering automatic isolation in Microsoft Defender for Endpoint for servers and selected high-value devices when specific, high-confidence custom detections fire—for…

Should we automatically isolate servers and high-value devices based on Defender detections?

We don't have a 24/7 SOC, so we're considering automatic isolation for servers and other high-value devices when Microsoft Defender for Endpoint triggers custom, high-confidence detections—for example, a…

Can Defender for Endpoint block custom process behavior like CrowdStrike IOAs?

I'm trying to determine whether Defender for Endpoint has an equivalent to CrowdStrike's Indicators of Attack that can block a specific behavior immediately, rather than only detect it…

Windows Server 2025 ignores Intune ASR policies while other MDE policies apply

I have a physical Windows Server 2025 Hyper-V host onboarded to Microsoft Defender for Endpoint through Azure Arc and managed with MDE Security Settings Management. The device appears…

Do you build custom detections with Microsoft Defender for Endpoint?

I was reading about a recent PaperCut exploit where suspicious activity was identified through commands such as whoami and local administrator-group enumeration. I tested several unusual commands in…