Microsoft Defender XDR Certified Expertise, 24/7 Support, Optimization, Investigation and Response
Stop advanced threats and minimize the risk of business disruption across your users, endpoints, and cloud applications. eSentire MDR with Microsoft Defender XDR enriches, operationalizes and drives response for new and existing Microsoft alerts using the eSentire Atlas XDR Platform.
Microsoft Defender for Endpoint
Microsoft Defender for Office 365
Microsoft Defender for Identity and Cloud Apps
ESENTIRE MDR WITH MICROSOFT DEFENDER XDR
Microsoft Defender for Endpoint
Endpoint protection, detection, response, and remediation
Telemetry used:
Processes, files, network connections, registry changes
Examples of detections investigated by the eSentire SOC:
Malware in a zip file, credential theft phish, suspicious service launch, a file or network connection related to ransomware, known attack IOCs, and suspicious files
Hunt
Microsoft Defender for Endpoint combined with original threat research from eSentire’s Threat Research Unit (TRU) enables threat hunting at scale and the detection of advanced and persistent attackers.
Isolate
Locks down and isolates threat actors on your behalf preventing lateral spread and potential business disruption.
Investigate
eSentire SOC Cyber Analysts perform rapid forensic investigation and root cause determination to round out the “who”, “what”, “when”, “where”, and “why” of an incident.
Remediation
Managed remediation eradicates threat actor presence, gets machines back to full production and applies lessons learned to harden your endpoint posture.
Single Agent
A single endpoint security platform built into Windows and the Microsoft Cloud that collects all endpoint data, sending all activity that has not been seen before to eSentire’s Elite Threat Hunters.
Block
Applying predictive threat modeling, eSentire Microsoft security experts manage and tune prevention measures ensuring automated blocking of known, unknown and fileless attacks.
ESENTIRE MDR WITH MICROSOFT DEFENDER XDR
Microsoft Defender for Office 365
Mitigate the risk of phishing and business email compromise
Telemetry used:
Sender IPs and domains, email heuristics, sandboxed files and links, and behavioral analytics
Examples of detections investigated by the eSentire SOC:
Malicious URL clicked, malware detected in email, suspicious email forwarding, suspicious email sending patterns, suspicious email containing malware, phishing URLs, delivery attempts of phishing emails, malicious file or malicious URL removed after delivery, and mailbox granted permissions and reported emails by user
Optimize Your Email and File Security
Combine leading email security technology with human expertise to achieve optimal posture around email, file sharing (Sharepoint, OneDrive), and enterprise communications (Microsoft Teams).
Business Email Compromise (BEC) Resilience
Alerts on indicators of account compromise and user impersonation are escalated to eSentire experts who can leverage the entire Microsoft Defender XDR suite to make informed decisions on your behalf.
Contain Email Risks
Fast response and remediation of threats stemming from the email vector, minimizing the risk of an attacker spreading laterally in your network, resulting in a more responsive security operation.
ESENTIRE MDR WITH MICROSOFT DEFENDER XDR
Microsoft Defender for Identity
Investigate and respond to compromised identities and insider threats
Telemetry used:
AD activity, Entra ID active parsed network traffic, windows event logs
Examples of detections investigated by the eSentire SOC:
Pass the certificate, suspected domain controller promotion, encryption downgrade, forged authorization data, ticket and time anomaly, and suspected brute force attacks.
Microsoft Defender for Cloud Apps
Rich visibility into data and user activity across your cloud SaaS applications
Telemetry used:
Cloud traffic, cloud traffic logs, relevant telemetry from specific cloud apps
Examples of detections investigated by the eSentire SOC:
Suspected identity theft
Optimal Configuration for MDR
A dedicated Microsoft expert will work with you to optimize various security components within Microsoft Defender for Cloud Apps.
Extended Visibility into Cloud Applications
Detect threats related to risky or suspicious user activity across your environment and within your business-critical cloud SaaS applications.
Investigation and Analysis of User Risks
Elite Threat hunters and 24/7 SOC analysts investigate all identity-related security events and leverage user access context for investigations stemming from other Microsoft Defender XDR products.
Identity-Based Response and Remediation
Revoke access to specific Microsoft cloud applications, suspend user credentials organization-wide, and force password resets to respond to risks related to compromised user accounts and insider threats.
