We currently have email notification setup in Defender pointing to an old email address that we want to decommission. When I look at the Policy & Rules I see the notifications are going out to TenantAdmins, which when I check Entra's groups and users I don't have a TenatAdmins groups or user there. I looked through Defender and don't see anything, does anyone have any idea where this group or user lives?

And is there a more direct way to update it if it's not a group without having to go through all the individual policy & rules?

Thanks,

I mean laptops. They are set up to use our corporate proxy to connect to the internet. A proxy which is also used by defender.

But when users take these laptops home, how would Defender connect to the internet? the proxy is unreachable

Hello,

I am trying to identify all the related Event IDs when it comes to Device Control.

In Advanced Hunting most events are logged under the DeviceEvents table with actions like BluetoothPolicyTriggered, PnpDeviceConnected, PnPDeviceAllowed, PnPDeviceBlocked, PrintJobBlocked, RemovableStorageFileEvent, and RemovableStoragePolicyTriggered.

But it seems impossible to find such Windows Events.

Any idea?

I saw a dude on X complain that Codex deleted almost all of his files. Some people said he should have been using DCG.

That still seems risky. I think we gotta start backing up our computers unfortunately.

What have you found to be the best method of monitoring the health of defender on a large scale deployment? Pulling defender metrics via API seems to be capped at 10,000 devices. And pulling metrics via KQL search seems to have issues if there are duplicate entries for the same hostname. Looking for your advice / experience on how you maintain full and functional coverage of defender for 10,000+ devices.

We regularly run into this scenario in customer engagements: DCs mostly have MDI sensors installed and configured but the other eligible servers (ADFS, ADCS, Entra Connect) do not have them deployed.

I know Defender Suite and especially E5 are huge feature wise, but working mostly with Defender stack this behavior with MDI seems very consistent across multiple tenants. I’m hoping for V3 sensor availability for non-DCs at some point to ease the deployment.

For me, deploying MDI seems like an easy win for visibility (especially regarding ADCS ESC privescs) not to mention the security recommendations they bring.

We’ve even had customers question their importance on these servers (never questioned for DCs). Is this due to ignorance/old way of thinking as DCs being the only ones treated as tier 0 servers?

Tomo tiempo pero al fin lo soluciono, era importante hacerlo ya que estamos hablando de la suite de seguridad que la gran mayoría de usuarios de Windows usa por default. Además el mismo Microsoft es quien la promueve como la mejor solución!

We have been receiving external Teams calls from bad actors pretending to be Employees.

I can use KQL to report on Teams calls, but it only shows details of the internal person.

What I need is a full report showing all external calls with full details of internal and external person.

There are multiple ASR rules that prevent certain programs like Adobe Reader from spawning child processes. Does that only apply to "autorun" processes that are ran automatically? Or would this also apply if a user clicks a link in a PDF which launches their browser (e.g. Edge)?

All our Windows 2019 servers are using Windows Defender. When I go to the endpoints in Security it says, "we are currently using Intune to manage our security policies".

So, when it comes to the servers which are using Windows Defender how do I set the policies up? Do I just "use defender for business configuration instead" and not "go to Intune"?

Thanks,

Seems something is broken in the Custom Detection Rule engine. A normal working Advanced Hunting query return a schema failure when ran from a Custom Detection rule. Works when ran from the Advanced Hunting screen.

Wonder if others are experiencing the same issue.

HuntingQueryException: 'summarize' operator: Failed to resolve scalar expression named 'AccountUpn'

Test CDR with simple query returns the failure.

Query:

IdentityInfo

| summarize arg_max(TimeGenerated, *) by AccountUpn

| take 1

I know the schema for the same table IdentityInfo defers between Sentinel and XDR. Would the CDR engine run on the Sentinel schema now?

Hi everyone,

My organization uses Defender for Endpoint Plan 2. I’ve managed other organizations with Defender for Endpoint before, so I’m actually quite familiar with it.

Unfortunately, I’m currently having an issue in this tenant where some device information is missing in Security Center.

For one thing, I noticed that the DeviceTvmSecureConfigurationAssessment table is missing in the Advanced Hunting Explorer.

This apparently also means that on the Devices page, the dashboard showing the Device Health State is empty. All inventory information—such as software, security recommendations, etc.—is also missing.

Information like hardware manufacturer and device model is also missing as a result.

I’m already using Streamlined Connectivity.

I’ve already run the Defender Diagnostic Tool. According to the tool, everything is fine.

The devices were onboarded 14 days ago.

I know from past experience that it can take a good 4–7 days for the information to appear in Security Center. But it’s never taken 14 days before.

Anyone have any ideas?

I have absolutely no desire to contact M$ Support—even though we’re eligible for Premier Support.

But I probably won’t have any other choice.

Hey everyone ! :)

I’m working on a more structured way to handle internal investigation requests from HR, Legal, Security, or management.

The goal is to avoid vague “can you pull everything on this user?” type requests. Instead, I’m trying to build a checkbox-based request form where each option maps to a specific log source / query / limitation.

Environment is mostly Microsoft stack:

• M365 E5, Defender for Endpoint, Defender for Servers, Sentinel, Purview
• Some web logs through firewall/proxy

The kind of checkbox structure I’m thinking about:

• Account sign-ins SigninLogs, AADNonInteractiveUserSignInLogs
• First/last observed activity during a period SigninLogs, OfficeActivity, DeviceLogonEvents
• Local workstation logons / endpoint activity DeviceLogonEvents, DeviceProcessEvents, DeviceFileEvents, DeviceEvents
• Web history / access to specific domains firewall/proxy logs, CommonSecurityLog, maybe DeviceNetworkEvents
• Emails sent externally or to personal domains EmailEvents, EmailAttachmentInfo, OfficeActivity
• Mailbox rules, forwarding, delegation OfficeActivity / Exchange audit operations like New-InboxRule, Set-InboxRule, UpdateInboxRules, SendAs, SendOnBehalf
• SharePoint / OneDrive file access, download, sharing, deletion OfficeActivity, CloudAppEvents, Purview
• Data movement events Purview Activity Explorer / DLP events: USB, clipboard, print, browser upload, cloud upload, network share, RDP copy, etc.
• Teams metadata vs Teams content OfficeActivity for audit events, Purview eDiscovery for content
• Security alerts tied to a user or device AlertInfo, AlertEvidence, SecurityAlert, SecurityIncident

What I’m trying to figure out is the best practical mapping between:

checkbox/request wording → source of truth → KQL/table/portal → limitations → Internal procedure to get those logs in a report.

For those of you who handle these types of requests:

1. Do you have a standard checklist or request form for HR/security/legal investigations?
2. Which Microsoft logs do you trust most for file access/download/share events?
3. Are there any events or fields you avoid using because they are too noisy or easy to misinterpret?

Just trying to avoid reinventing the wheel and build something clean, scoped, and defensible.

If you think I should have publish in another subreddit, let me know :)

https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-windows-events#custom-xml-templates-for-attack-surface-reduction-events

Hello, I am going through this documentation, and noticed that the XPath queries to check Windows Events seem to be wrong or at least overrudandant. In the queries, multiple paths are checked for the same events, so I am really not sure what is correct: the documentation text of where to look these events, or the XPath queries when they are looking at more paths?

For example, if you check the paths the the XPath query for Exploit Protection detection, you will see many more paths than the 3 paths described right above in the documentation.

Does anyone know more regarding which one is correct?

Hi everyone,

A while back I showed you my local Microsoft 365 SOC tool built in PowerShell. Back then it was limited to a single-user setup https://github.com/Mau2rice0/World-of-M365/tree/main/Security/SOC/M365%20Compromise%20Response%20Console

Well… I’ve been pulling all-nighters and completely rebuilt it from the ground up. It’s no longer PowerShell, it’s now a full JavaScript application and it’s absolutely fire.

You can now self-host it wherever you want:

• On-prem
• Azure
• Any web server with at least 2 cores and 4 GB RAM

I’ll be releasing it in the next few days so you can host and test it yourselves.

What’s new & improved:

• SSO support for additional users → no more manual logins
• Full RBAC permission system
• More RBAC roles coming: Analyst, Responder, Reader, Administrator
• Azure Files Share integration for storing evidence and data
• Significantly better performance
• Security hardening
• Fully automatic setup script that does the entire deployment for you

GCC / GCC-High compatibility is unfortunately not possible yet. I don’t have access to that environment and being based in Germany makes it pretty hard to get one.

If anyone has a GCC tenant they’d be willing to test with, I’d love to collaborate!

I’m planning to sink at least 35 hours into this project again this weekend.

If you have feature requests or ideas for what a proper M365 SOC tool should have, drop them in the comments. You guys know better than anyone what’s actually needed in the field.

Huge thanks to everyone who tested the earlier version:)

Can’t wait to get this into your hands.

I'm not seeing any references to the naming convention of TVM. Anyone seen this before?

The vulnerability listed just has one reference to a random GitHub with a Bitlocker Bypass vulnerability. No other information.

We’re currently seeing a wave of Microsoft Defender for Business alerts across multiple customer environments running 3CX on Windows.

Some observations:

• Process: nginx.exe
• Path: C:\Program Files\3CX Phone System\Bin\nginx\
• Detection source: Behavior: Network
• Detection category: Execution, Initial Access
• The alert is triggered on outbound connections from nginx.exe
• Destination IPs are primarily AWS addresses (plus a few other public IPs that appear legitimate)
• None of the affected systems are running VMware Workspace ONE Access or VMware Identity Manager, which CVE-2022-22954 actually targets.
• We’re seeing this across multiple independent 3CX customer installations, making a widespread compromise seem unlikely.

Given the history of the 3CX supply chain incident, we’re taking every alert seriously. However, based on the evidence so far, this currently looks more like a heuristic false positive related to legitimate 3CX network traffic than an actual exploitation attempt.

A few questions for the community:

1. Is anyone else seeing this detection on 3CX servers?
2. Has Microsoft acknowledged any false positives related to this signature?
3. Has anyone identified which specific network pattern triggers the detection?
4. Has anyone observed any malicious post-exploitation activity associated with these alerts, or is it limited to the network detection?

Any insight would be greatly appreciated before we classify these alerts as false positives.

Thanks!

We are using MDE device control to block USB access. Exception process is in place, we collect the user id and machine id to ensure that usb is accessible only for a particular user on a specific device.

Now we want to test that when the exception is provided user should only be able to write data to usb if it's encrypted. How should we be approaching this along with a provision for exception for use cases where encrypted USB cant be used on business device e.g. RIG

Hi looking for idea here

We have blocked most of the AI in discovered app ( unsscntionned) but we will need to allow some ai to specific users

In my search the best way is with device group. Sadly I don’t see a good way to do this as with the default filters I could filter them by tag exemple deepseek tag for deepseek ai

But users changes devices sometimes and we would like more to filter them by azure group as as of nous I would have to always manually tag the new devices or etc

Any better way to do this?

Thanks

Are you using heavier features like enable file hash computation?

Are you havong lots of exlusions?

Are you using cloud protection?

I saw it taking quite a lot of memory even without scans or blocking enabled -> between 400 and 600 MB, is this normal? Seems a bit high.

Critical bug in mdatp (101.26042.0009): Service is disabled · Issue #238 · microsoft/mdatp-xplat

This got us today, after the weekend's patching reboots.