New role, same mission
Aug 20th, 2022 by Jesper Kråkhede
Some personal news. This month I started a new role as Technical Specialist at Microsoft. I´ll still be involved in incidents, but more as an advisor, helping customers get the most out of the security tools they already have, and helping them set them up so the next incident hurts less.
That means I´ll be spending a lot more time in the Defender stack, so you will see more posts about it here. A quick overview for those who haven´t looked at it lately.
Microsoft 365 Defender ties it all together in one portal, with incidents that combine signals from all the products below. Defender for Endpoint protects and detects on clients and servers, and can isolate a machine with one click. Defender for Office 365 protects mail and collaboration from phishing and malware. Defender for Identity watches Active Directory for the things I have been writing about for years: credential theft, lateral movement, reconnaissance. Defender for Cloud Apps keeps an eye on SaaS applications and shadow IT. Defender for Cloud protects workloads in Azure and other clouds. And Microsoft Sentinel brings in everything else and gives the SOC a place to hunt.
The best part, from an incident responder´s point of view, is that the signals are connected. An alert on a laptop is linked to the identity, the mail and the cloud app in the same incident.
Same mission as always. Just with better tools.