book

Microsoft Defender for Identity in Depth

Name: Microsoft Defender for Identity in Depth
Author: Pierre Thoor
ISBN: 9781835884485

by Pierre Thoor

December 2024

Intermediate to advanced

380 pages

9h 59m

English

Packt Publishing

Read now

Unlock full access

Microsoft Defender for Identity in Depth
Foreword
Contributors
About the author
About the reviewers
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the example code filesConventions usedGet in touchShare Your ThoughtsDownload a free PDF copy of this book
Part 1:Mastering the Fundamentals of Microsoft Defender for Identity
Chapter 1: Introduction to Microsoft Defender for Identity
The growing threat landscape and the role of MDI in ITDRModern identity threats and strategic defense frameworksThe Cyber Kill ChainMITRE ATT&CK frameworkThe Unified Kill ChainMDI’s strategic position in the cybersecurity ecosystemUnpacking key features and benefits of MDISummary
Chapter 2: Setting up Microsoft Defender for Identity
Technical requirementsPre-installation and planning checklist: laying the groundworkLicensingWhat permissions do you need?What are the operating system requirements?Other sensor requirementsNetworkingPowerShellData collectionUser profilingSizingPrerequisites for AD FS and AD CSActive Directory service accountsDeployment of MDI – a step-by-step guideFollowing with your own lab environmentGetting the MDI installation package and access keyNavigating step-by-step proxy configuration for MDIInstalling TinyProxyConfiguring TinyProxyEnsuring success with post-installation activitiesDSAsConfiguring SAM-RSetting the gMSA in the Defender XDR portalVerifying the DSADefender XDR unified RBACSummary
Chapter 3: Leveraging MDI PowerShell for Automation and Management
Technical requirementsPrimer on the MDI PowerShell moduleInstalling the MDI PowerShell moduleModule file overviewUnderstanding the module and its functionsCrafting advanced PowerShell scripts for MDI managementHealth issues APIAutomation in action – case studies and scripting scenariosMonitoring the MDI service via Azure MonitorMonitoring the MDI configuration with Azure Monitor and custom alert rulesSending health issues and security alerts via syslog to Microsoft SentinelSummary
Part 2: Advanced Configuration, Integration, and Threat Detection

Chapter 4: Integrating MDI with AD FS, AD CS, and Entra Connect
Technical requirementsIntegrating MDI with AD FSHow AD FS authentication worksConfiguring AD FS for MDI sensor installationValidating the AD FS integrationIntegrating MDI with AD CSHow AD CS worksImportance of MDI on Certificate ServersConfiguring AD CS for MDI sensor installationValidating the AD CS integrationIntegrating MDI with Entra ConnectHow Entra Connect worksConfiguring Entra Connect for the MDI sensorValidating the Entra Connect integrationExpanding MDI across multiple Active Directory forestsThe concept of multiple forestsTypes of trusts in multi-forest environmentsPrerequisites for MDI in a multi-forest environmentVPN integration – securing remote activities and data flowUnderstanding RRAS and RADIUSConfiguring Microsoft RRASSummary
Chapter 5: Extending MDI Capabilities Through APIs
Technical requirementsIntroduction to the MDI APIGetting started with Microsoft Graph APIBuilding custom integrations and automationsIdentifying integration opportunitiesType of use casesSummary
Chapter 6: Mastering KQL for Advanced Threat Detection in MDI
Technical requirementsKQL for beginners – querying MDI dataThe history of KQL and its ecosystemUnderstanding your MDI dataGetting started with KQLPractical tips for effective queriesHunting tables in MDIPractical use of hunting tablesAdvanced KQL techniques for deep threat detectionUnderstanding attack paths in ADMDI and the attacker’s kill chainCrafting KQL queries for threat detectionReal-world case studies – detecting advanced attacks with KQLPrerequisitesPtH attackKerberoastingDCShadow attackSummaryFurther reading
Part 3: Operational Excellence with Microsoft Defender for Identity
Chapter 7: Investigating and Responding to Security Alerts
Developing a methodical approach to alert investigationUnderstanding the MDI alert systemUser EntityLateral movement paths (LMPs)Initial triage and categorizationRoot cause analysisReal-world playbook – responding to advanced threatsDefining advanced threatsPre-incident preparationIncident detection and validationResponse strategy and executionIncident response – an action plan for high-stakes situationsBuilding an incident response teamIncident Response Plan (IRP)Summary
Chapter 8: Utilizing MDI Action Accounts Effectively
Technical requirementsConfiguring and securing action accountsUnderstanding action accounts – what are they and why do they matter?Best practices for action account configuration – getting it right the first timeSecurity measures – protecting your action accounts from compromiseReal-world scenarios and use casesAutomated threat response – leveraging action accounts for quick reactionsCase study – detecting and responding to credential theft and lateral movementOperational efficiency – how action accounts streamline security processesSummary
Chapter 9: Building a Resilient Identity Threat Detection and Response Framework
Technical requirementsDesigning proactive threat-hunting strategies with MDIUnderstanding the threat-hunting methodologyThe importance of logging and accurate detectionDeveloping security use casesLeveraging behavioral analytics and MDI in hypothesis-driven huntingElevating your ITDR posture – Continuous improvement with MDILearning from total identity compromise incidentsImplementing identity-hardening strategiesDisaster recovery and incident response – preparing for the inevitableEstablishing an incident response planAutomating responses to identity-based incidents with SOARDisaster recovery for identity systemsSummary
Chapter 10: Navigating Challenges: MDI Troubleshooting and Optimization
Diagnosing common MDI issuesSpotting the signs of troubleUsing tools and logs to find problemsConfiguration and connectivity fixesChecking key configuration settingsRemoving a malfunctioning MDI sensor manuallyNetwork connectivity troubleshootingResolving security alert misfiresCustomizing detection rules and applying filtering techniquesAdjusting alert settings for better accuracyOperational guideDaily tasksWeekly tasksMonthly tasksQuarterly/ad-hoc tasksSummaryFuture reading
Index
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youShare Your ThoughtsDownload a free PDF copy of this book

Content preview from Microsoft Defender for Identity in Depth

1 Introduction to Microsoft Defender for Identity

In this starter chapter, we’ll start boarding ourselves on the journey of Microsoft Defender for Identity (MDI) and its critical role within the evolving threat landscape. We’ll get insights into the strategic importance of MDI within the broader cybersecurity ecosystem, learning how it serves as a fundamental tool in Identity Threat Detection and Response (ITDR), which is a term from Gartner. This chapter will explore how MDI fits within the broader cybersecurity ecosystem, providing vital tools for protecting against identity-based threats.

Instead of jumping straight into the technical setup, we’ll take time to explore the why behind MDI. Understanding these foundational aspects will give ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Microsoft Defender for Endpoint in Depth

Publisher Resources

ISBN: 9781835884485

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Microsoft Defender for Identity in Depth

by Pierre Thoor

1

Introduction to Microsoft Defender for Identity

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.