LATEST BLOGS
How to integrate Microsoft Defender/ Sentinel with Microsoft Fabric
Since September 23, 2026, the Microsoft Sentinel data lake is no longer a separate onboarding and billing project: it comes integrated with Sentinel for every customer. The bigger change is where the advanced work happens. Day-to-day SOC work (hunting, workbooks,...
How to track browser extension installations with Microsoft Defender
Browser extensions are small pieces of software, but from a security perspective, they can have a surprisingly large impact. From data theft to session-token leakage, a compromised or malicious browser extension can introduce risks that are easy to overlook. Extensions...
Microsoft Defender XDR Attack Disruption: Automatic Device Isolation Explained
Microsoft continues to evolve Automatic Attack Disruption in Microsoft Defender XDR, moving security operations beyond detection toward automatically interrupting attacks while they are still in progress. Until now, Attack Disruption could contain suspicious or compromised devices discovered in the network....
Auditing Microsoft Defender and Intune Configuration Changes
Microsoft is clearly moving toward a more unified security operations experience within the Defender portal. Over the last few years, we have seen Microsoft bring more security capabilities together under the Defender platform. Instead of working with completely separate portals...
Microsoft Defender Threat Intelligence: Native Defender Integration and API Access
Previously, Microsoft Defender Threat Intelligence (MDTI) was offered as a separate product and portal experience. Organizations that wanted access to the full Defender TI capabilities required an additional premium license, which could cost tens of thousands of dollars per year...
How to collect Microsoft Defender Client Analyzer Files via MDE Live Response
When troubleshooting Microsoft Defender for Endpoint (MDE) issues, Microsoft Support or internal IT teams often request Defender Client Analyzer logs. Traditionally, collecting these logs requires local access to the endpoint. Using Live Response, you can remotely execute the Microsoft Defender...
Defender for Endpoint performance troubleshooting on Linux
Microsoft Defender for Endpoint (MDE) provides advanced endpoint protection, detection, and response capabilities for Linux systems. While the solution is designed to operate efficiently, administrators may occasionally experience performance issues such as high CPU utilization, excessive memory consumption, increased disk...
Configure AI agent runtime protection (preview) with Microsoft Defender for Endpoint
Artificial Intelligence (AI) agents are becoming part of more and more workflows. From coding assistants and CLI-based agents to autonomous desktop applications, these tools can read files, execute commands, interact with APIs, and perform tasks on behalf of users. This...
Closing the Azure AD Graph Visibility Gap: Why AADGraphActivityLogs is important for Defenders
For years, defenders relied on MicrosoftGraphActivityLogs to monitor Graph API activity in Microsoft Entra ID. However, this visibility was incomplete because the table only captures requests to Microsoft Graph (graph.microsoft.com) and does not include activity against the legacy Azure AD...
Disable alert generation for Unsanctioned Apps in Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps (MDCA) can integrate with Defender for Endpoint (MDE). With the integration, it is possible to get an out-of-the-box cloud app discovery view of the used apps and Shadow IT. When blocking apps via Defender for...
Load more
Microsoft MVP
Need assistance by Jeffrey?
MDE blog series
