book

Mastering Microsoft Defender for Office 365

Name: Mastering Microsoft Defender for Office 365
Author: Samuel Soto
ISBN: 9781835468289

by Samuel Soto

September 2024

Intermediate to advanced

426 pages

12h 22m

English

Packt Publishing

Read now

Unlock full access

Mastering Microsoft Defender for Office 365
Contributors
About the author About the reviewers
Preface
Who this book is forWhat this book coversTo get the most out of this bookConventions usedGet in touchShare Your ThoughtsDownload a free PDF copy of this book
Part 1 – Introduction and Basic Configuration
Chapter 1: The Security Wild West
The cyber threat landscape – how do others get attacked?Cyber threats and their evolutionThe role of emerging technologiesThe human factorCommon attack vectors related to Office 365Email-based attacksCredential theftThird-party integrationsCloud-based attacksMalicious insidersOffice productivity tool deployments – how do others deploy?Components of Microsoft 365Microsoft 365 cloud architectureMicrosoft Defender – a primerOverview of the Microsoft Defender ecosystemHolistic approach to security and Zero TrustProtecting your productivity toolsEOP componentsLicensing for EOPDefender for Office 365 – why not just stay with EOP?Understanding the ROIThe direct and indirect costs of cyber threatsThe impact of Defender for Office 365 on ROISummaryReferences
Chapter 2: Basic Components of Defender for Office 365
Blocking malicious files and attachmentsSafe AttachmentsSafe DocumentsSafe Attachments for SharePoint, OneDrive, and TeamsProtecting from malicious links and phishingSafe Links technologyAnti-phishing policiesEmpowering your usersThe Report Message add-inProtecting against compromised internal accounts or devicesHow advanced protection for internal mail worksExamples of attacks mitigatedKnowing and investigating what is happening in your environmentReal-time reportsThreat trackersCampaign viewsAutomated investigation and responseIntegration with other Defender security productsMicrosoft Defender for EndpointMicrosoft Defender for Cloud AppsMicrosoft Purview Data Loss PreventionHow Defender for Office 365 could have averted famous attacksDemocratic National Committee email hackSony Pictures Entertainment hackSummaryReferences
Chapter 3: Basic Checks and Balances
Common security frameworks and approachesISO 27001NIST Cybersecurity FrameworkHIPAAPCI DSSGDPRFISMAWhat are an organization’s vision, policies, and procedures?Vision in cybersecurityCybersecurity policiesCybersecurity proceduresIntegration and importanceIdentifying an organization’s needs and quantifying theseSummaryReferences
Chapter 4: Basics of Configuration
Preparation and prerequisitesLicensesPermissions requiredIt is all about the organization’s risk profileCreating the proper risk profileRisk profiles in Defender for Office 365Looking deeper into preset policiesConfiguring the preset policiesThe administrative portalsEnabling Standard protection preset policiesEnabling Strict protection preset policiesSummaryReferences
Part 2 - Day-to-Day Operations
Chapter 5: Common Troubleshooting
Is this working properly?Users impactedSystems impactedBlast radiusApplying the Pareto principleAnalyzing incident impactContinuous monitoring and feedbackWhere do I find what is wrong?Audit log searchMailbox auditingThe Incidents pageHas this been fixed before?Step-by-step guidesMicrosoft Service Health Status pageMicrosoft 365 troubleshooting libraryMicrosoft Community HubMicrosoft paid supportSummaryReferences

Chapter 6: Message Quarantine Procedures
I stopped the message. Now what?Identifying quarantined email messagesVerifying the validity of quarantined messagesHow Defender for Office 365 quarantines emailsQuarantining Teams messagesEveryone gets a seat at the quarantine tableOptions available for the user management of quarantined messagesStep-by-step actions to manage quarantined messagesPoliciesQuarantine policyQuarantine notifications, global settingsInbound anti-spam policyImplementing policies and simplifying your approachOrder of implementationConfiguring the quarantine policyQuarantine notification settingsAnti-spam policySummaryReferences
Chapter 7: Strengthening Email Security
Phishing – a danger both inbound and outboundAnti-phishing policiesPolicy sections and fieldsConfiguring anti-phishing policiesStopping outbound spamLet’s start with authenticationConfiguring SPF, DMARC, and DKIMOutbound spam filteringOutbound anti-spam policiesConfiguring outbound anti-spam policiesSummaryReferences
Chapter 8: Catching What Passed the Initial Controls
Understanding email flowInbound mail flowWhat about the outbound mail flow?Mail flow rulesMessage tracing – unveiling the mystery of your emailsDiving deep into Safe Links policies – protecting your users from malicious URLsUser warningsSafe Links policiesKeeping malicious files outAnti-malware policiesSafe Attachment policiesExtending beyond emailPolicy prioritiesAlert policiesAlert policy fieldsConfiguring alert policiesSummaryReferences
Chapter 9: Incidents and Security Operations
A holistic view of Microsoft Defender XDRIncidents and more incidentsKnowing how to prioritizeFiltersManaging incidentsUnderstanding the information on the incidentAIRA high-level overview of AIRAlerts that trigger AIRReviewing AIR pending actionsViewing AIR resultsManaging false positives and false negativesSecurity operationsDaily activitiesWeekly activitiesAd hoc activitiesSummaryReferences
Part 3 – Making the Tool Work for Your Organization
Chapter 10: Magnifying the Unseen – Threat Intelligence and Reports
Threat intelligence comes to the rescueThe Threat analytics dashboardThe threat analytics reportGoing a step further with Defender TIIntel ProfilesIntel ExplorerIntel projectsSecurity reportsPermissions requiredThe compromised users reportThe Exchange Transport Rule reportThe Auto forwarded messages reportThe Mailflow status reportMail latency reportThe Post-delivery activities reportThe Spoof detections reportThe Submissions reportThe Threat protection status reportThe Top Malware ReportThe Top senders and recipients reportThe URL threat protection reportThe User reported messages reportSummaryReferences
Chapter 11: Integration and Artificial Intelligence
Introducing APIsThe Microsoft Graph security APIThe advanced hunting APIThe Alerts_v2 APIThe Alerts API (Legacy API)The Incidents APIThe attack simulation APIThe secure score APIThe Threat Intelligence APIAPI exploration and integrationAI to the rescueCopilot for SecurityDeploying Copilot for SecurityUsing Copilot for SecuritySummaryReferences
Chapter 12: User Awareness and Education
Why we need to train usersIntroducing attack simulation trainingUsing simulations and payloadsUnderstanding payloadsCreating a simulationAutomating the trainingSimulation automationPayload automationTraining campaignsUnderstanding reports and insightsSummaryReferences
Index
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youShare Your ThoughtsDownload a free PDF copy of this book

Content preview from Mastering Microsoft Defender for Office 365

9 Incidents and Security Operations

In this chapter, we’ll explore the incidents that might happen even with strong safeguards in place and the valuable insights they can reveal. We will delve into the important elements of automated remediation, examining these procedures and understanding the immediate responses. Our focus in this chapter will be establishing processes to investigate and manage all incidents generated by Defender for Office 365, leveraging automation to ease our workload, and fine-tuning our tools by pinpointing and correcting false detections.

Our processes will also be enriched by learning to break down incidents to understand the root cause, as well as how to enlist Microsoft to help with more advanced changes and improvement ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781835468289

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Mastering Microsoft Defender for Office 365

by Samuel Soto

9

Incidents and Security Operations

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.