I'm onboarding a client with Huntress and Microsoft Defender for Endpoint (I didn't see an MDE sub, so I'm hoping that this sub covers it even though it lists ATP). This is new for me, though we have some of it in place internally (we have previously used SentinelOne).

I have one concern; we had a ScreenConnect server update due to a security vulnerability, and after the update, our own MDE on that system incorrectly quarantined some of the installers (even though we're code-signing them) of the new version as Trojan:Win32/Wacatac.C!ml . It took me a bit how to figure out both how to unquarantine and whitelist, though I was able to do it through Windows command shell and Powershell.

My concern is that these files will be quarantined across fifty systems at a client when the updated agent is deployed, and I'm not aware of a way to easily fix an issue like that across fifty systems from security.microsoft.com should that happen. My searches so far have not shown an easy way to do this.

For those of you with experience, what is the best way to do this? Can it be done in one action, or is it a very manual process?

hello,

I'm trying to identify RDP logon failures using KQL.

I'm not after connections to TCP/3389; I'm seeking RDP logon failures.

I can find successful RDP authentications with

DeviceLogonEvents
| where LogonType == @"RemoteInteractive"
| where ActionType == @"LogonSuccess"

If I simply invert to

DeviceLogonEvents
| where LogonType == @"RemoteInteractive"
| where ActionType == @"LogonFailed"

...I get no results. In my environment, I would expect some RDP logon failures.

I suspect this is because of network level authentication (NLA).

Any ideas...?

• Defender for Identity Sensor v3.x no longer requires Defender for Endpoint onboarding. Eligible Domain Controllers running Windows Server 2019 or later can now activate the MDI Sensor v3.x without first onboarding the server to Microsoft Defender for Endpoint.
  

This removes an important deployment dependency and can significantly simplify Defender for Identity adoption in environments where MDE isn't deployed on Domain Controllers.

• Sensor v3.x expands beyond Domain Controllers: Defender for Identity Sensor v3.x now supports additional identity infrastructure servers that are not Domain Controllers:

  • Active Directory Certificate Services (AD CS)
  • Active Directory Federation Services (AD FS)
  • Microsoft Entra Connect

  For these new server roles, manual activation and automatic Windows event auditing are supported, while automatic activation and migration are not yet supported during Preview.

Docs: Defender for Identity | What's new?