https://vertho.tech/tags/defender-xdr/Recent content in Defender XDR on VerthoHugoen-usMon, 11 May 2026 13:31:40 +0100https://vertho.tech/2026/02/11/identity-threat-detection-and-response-linking-accounts/Wed, 11 Feb 2026 11:53:18 +0100https://vertho.tech/2026/02/11/identity-threat-detection-and-response-linking-accounts/How to link the scattered accounts of one person into a single identity in Defender for Identity, manually or with custom correlation rules.https://vertho.tech/2026/01/28/defender-for-endpoint-migration-troubleshooting-persistent-third-party-av-registration/Wed, 28 Jan 2026 22:59:34 +0100https://vertho.tech/2026/01/28/defender-for-endpoint-migration-troubleshooting-persistent-third-party-av-registration/A third-party antivirus stays registered in Windows after uninstalling it and keeps Defender in a disabled state. How we found and removed the leftover registration.https://vertho.tech/2025/12/01/mdi-configurator-v1-0-is-out/Mon, 01 Dec 2025 15:29:41 +0100https://vertho.tech/2025/12/01/mdi-configurator-v1-0-is-out/MDI-configurator v1.0: a free PowerShell GUI to configure, test and report on Microsoft Defender for Identity without remembering the commands.https://vertho.tech/2025/10/22/remotely-intune-wipe-devices-in-defender-for-endpoint-isolation-mode/Wed, 22 Oct 2025 15:12:10 +0100https://vertho.tech/2025/10/22/remotely-intune-wipe-devices-in-defender-for-endpoint-isolation-mode/Using the new isolation exclusions in Defender for Endpoint to remotely wipe a device with Intune while it stays in isolation mode.https://vertho.tech/2025/09/29/the-ultimate-defender-xdr-rbac-visualization/Mon, 29 Sep 2025 19:51:14 +0100https://vertho.tech/2025/09/29/the-ultimate-defender-xdr-rbac-visualization/A visual overview of the Microsoft Defender XDR Unified RBAC roles and permissions, to help you design your role model.https://vertho.tech/2025/08/27/guidance-on-how-to-manage-products-updates-for-defender-for-server-on-linux-distributions/Wed, 27 Aug 2025 08:43:50 +0100https://vertho.tech/2025/08/27/guidance-on-how-to-manage-products-updates-for-defender-for-server-on-linux-distributions/How to manage Defender for Endpoint product updates on Linux servers: package managers, update rings and the approach I recommend to customers.https://vertho.tech/2025/06/23/defender-av-mystery-solving-the-source-files-could-not-be-found/Mon, 23 Jun 2025 19:39:17 +0100https://vertho.tech/2025/06/23/defender-av-mystery-solving-the-source-files-could-not-be-found/Enabling the Defender Antivirus role on a Windows Server fails with "source files could not be found". Why this happens and how to solve it.https://vertho.tech/2025/06/07/mde-troubleshooter-v1-6-1-available/Sat, 07 Jun 2025 07:58:59 +0100https://vertho.tech/2025/06/07/mde-troubleshooter-v1-6-1-available/MDE-Troubleshooter v1.6.1 adds more Performance Analyzer options, new ASR rules and checks for Device Control, proxy settings and outdated signatures.https://vertho.tech/2025/05/07/defender-for-office-365-visualisation-of-the-tenant-allow-block-list-features/Wed, 07 May 2025 10:45:49 +0100https://vertho.tech/2025/05/07/defender-for-office-365-visualisation-of-the-tenant-allow-block-list-features/A visual overview of the Tenant Allow/Block List in Defender for Office 365: which entries exist and how each one affects mail flow.https://vertho.tech/2025/04/14/using-azure-arc-only-for-defender-for-servers-or-azure-monitoring-agent-lock-it-down/Mon, 14 Apr 2025 11:09:13 +0100https://vertho.tech/2025/04/14/using-azure-arc-only-for-defender-for-servers-or-azure-monitoring-agent-lock-it-down/If you only use Azure Arc for Defender for Servers or the Azure Monitoring Agent, disable the features you do not need. The security risks and how to lock it down.https://vertho.tech/2025/03/25/proactive-exposure-hunting-oauth-applications-and-azure-permissions/Tue, 25 Mar 2025 14:17:56 +0100https://vertho.tech/2025/03/25/proactive-exposure-hunting-oauth-applications-and-azure-permissions/KQL hunting queries for the Exposure Management tables that reveal risky OAuth applications and their Azure permissions before an attacker finds them.https://vertho.tech/2025/02/19/unleash-the-power-of-enterprise-exposure-graph-managed-identities-permissions-overview/Wed, 19 Feb 2025 16:57:07 +0100https://vertho.tech/2025/02/19/unleash-the-power-of-enterprise-exposure-graph-managed-identities-permissions-overview/Use the Enterprise Exposure Graph in Microsoft Exposure Management to build an overview of all managed identities and their Azure permissions with KQL.https://vertho.tech/2025/01/07/after-2-years-a-new-release-of-mde-troubleshooter/Tue, 07 Jan 2025 14:57:43 +0100https://vertho.tech/2025/01/07/after-2-years-a-new-release-of-mde-troubleshooter/MDE-Troubleshooter gets its first update in two years: new ASR rules, file hash computation check, Client Analyzer download and signature updates.https://vertho.tech/2025/01/03/new-ebook-demystifying-microsoft-defender-for-servers-by-james-agombar/Fri, 03 Jan 2025 15:07:30 +0100https://vertho.tech/2025/01/03/new-ebook-demystifying-microsoft-defender-for-servers-by-james-agombar/A new eBook by James Agombar covers the architecture, licensing, features and deployment of Defender for Servers. I was one of the technical reviewers.