Microsoft Defender for Endpoint Advanced Training Syllabus
1. Introduction to Microsoft Defender for Endpoint
- Overview
of Defender for Endpoint architecture and components
- Deployment
options and prerequisites
- Integration
with other Microsoft 365 Defender services
- Accessing
and navigating the Microsoft 365 Defender portal
2. Configuring and Managing Defender Policies
- Creating
and applying device compliance and security policies
- Configuring
Endpoint Detection and Response (EDR) policies
- Implementing
and tuning Attack Surface Reduction (ASR) rules
- Managing
firewall, network protection, and exploit protection features
- Policy
monitoring and troubleshooting
3. Threat & Vulnerability Management
- Fundamentals
of Threat and Vulnerability Management (TVM)
- Conducting
vulnerability assessments and prioritizing remediation
- Integrating
TVM data into organizational risk management
4. Advanced Threat Hunting
- Understanding
advanced hunting queries using Kusto Query Language (KQL)
- Creating
custom detection rules and threat hunting dashboards
- Using
Indicators of Compromise (IoCs) and Indicators of Attack (IoAs)
- Automated
investigation and response (AIR) capabilities
5. Incident Response and Investigation
- Investigating
alerts and incidents
- Using
advanced investigation tools and graphs
- Performing
remediation and containment actions
- Incident
lifecycle management and documentation
6. Automation and Integration
- Integrating
Defender for Endpoint with Security Information and Event Management
(SIEM) tools
- Using
PowerShell, Microsoft Graph API, and Logic Apps for automation
- Creating
automated response playbooks and workflows
- API
usage for security orchestration
7. Reporting and Analytics
- Generating
and customizing security reports
- Using
data analytics to identify trends and security posture
- Monitoring
security operations and continuous improvement
8. Device Management and Security Compliance
- Managing
device inventory, health, and security status
- Enforcing
endpoint compliance alongside Microsoft Intune
- Tamper
protection and secure boot configurations
9. Advanced Configurations and Best Practices
- Securing
identities with Azure AD integration
- Configuring
role-based access control (RBAC) for Defender
- Multilayered
defense strategy implementation
- Mitigating
complex attack vectors
10. Hands-on Labs and Real-World Scenarios
- Simulating
attack and response exercises
- Practical
configuration of policies and hunting queries
- Incident
response simulations with step-by-step remediation