Microsoft Defender XDR on justinverstijnen.nl

Microsoft Defender External Attack Surface Management (EASM)

Sun, 19 Jul 2026 00:00:00 +0000

What is Defender External Attack Surface Management (EASM)?

Microsoft Defender External Attack Surface Management (EASM) is a separate Defender solution which can be used to defend and monitor some of your external attack surfaces, like:

Websites
IP addresses
Domains
SSL certificates
Other digital assets

In addition to these components, EASM can also forward all relevant information and logs to SIEM solutions such as Microsoft Sentinel. It is also possible to manually input company-specific data, such as all domain names and IP addresses associated with its services.

Use Microsoft Defender for Endpoint with PowerShell

Sun, 21 Dec 2025 00:00:00 +0000

Requirements

To follow this guide, you need the following things:

A Windows 11/Server 2022 or 2025 device with Microsoft Defender for Endpoint enabled
PowerShell running with Administrator privileges
Basic knowledge of PowerShell

Short introduction to Microsoft Defender for Endpoint

Microsoft Defender for Endpoint is a security solution that protects laptops, desktops, servers, and mobile devices against malicious software and threats. It can detect suspicious activity, help investigate attacks, and helps notifying you of threats happening on your devices. It is part of the broader Microsoft security ecosystem and supports platforms such as Windows, macOS, Linux, iOS, and Android.

Penetration testing Defender for Identity and Active Directory

Fri, 21 Feb 2025 00:00:00 +0000

Requirements

At least one Microsoft Defender for Identity running
- For a step by step guide of this, refer this guide!
A domain controller (vm-jv-mdi)
A workstation (ws-jv-mdi)
Around 30 minutes of your time

Starting out

So I want to mention, that most of the attacks to Active Directory can be easily prevented if everybody locks their computer everytime they walk away from it and also use good enough authentication methods. Some other attacks cannot always be prevented but we can do the most of it detecting them and acting in a greatly manner.

How to monitor your Active Directory with Defender for Identity

Sat, 15 Feb 2025 00:00:00 +0000

Requirements

An Microsoft 365 tenant
A traditional Active Directory (AD DS) environment which meets the system requirements and is Server 2016+
A license that has Defender for Identity included, like;
- Enterprise Mobility & Security E5
- E5 or E5 security add-on
- Standalone Defender for Identity license
- F5 Security add-on with F1 or F3 license already in place
- Source: https://learn.microsoft.com/en-us/defender-for-identity/deploy/prerequisites#licensing-requirements
Around 60 minutes of your time
A drink of your choice

What is Microsoft Defender for Identity (MDI)?

Microsoft Defender for Identity (MDI for short) is a comprehensive security and monitoring tool which is part of the Microsoft XDR suite that defends your Windows Server-based Active Directory (AD DS). This does it by installing agents on every domain controller and so monitoring every authentication request.