Microsoft Defender

Microsoft Defender for Identity is a cloud-based security solution that leverages your on-premise Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organisation.  You can:

• Monitor users, entity behaviour and activities with learning-based analytics
• Protect user identities and credentials stored in Active Directory
• Identify and investigate suspicious user activities and advanced attacks
• Provide clear incident information on a simple timeline for fast triage

Defender for Endpoints is capable of:

• Quickly identify and stop threats and attacks
• Easily scale your security posture to prioritise risks and elevate your security when required.
• Evolve your defence strategy extending XDR and Zero Trust.

Defender for Endpoints also leverages the other elements of the Microsoft Technology stack:

• Endpoint behavioural sensors: Embedded in Windows 10, these sensors collect and process behavioural signals from the operating system and send this sensor data to your private cloud instance of Microsoft Defender.
• Cloud security analytics: Leveraging big-data, device learning, and unique Microsoft optics across the Windows ecosystem, enterprise cloud products (such as Office 365), and online assets, behavioural signals are translated into insights, detections, and recommended responses.
• Threat intelligence: Generated by Microsoft hunters, security teams, and augmented by threat intelligence provided by partners, threat intelligence enables Defender for Endpoint to identify attacker tools, techniques, and procedures, and generate alerts when they are observed in collected sensor data.