You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-xdr/auditing.md
+6-5Lines changed: 6 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,10 +3,10 @@ title: How to search the audit logs for actions performed by Defender Experts
3
3
ms.reviewer:
4
4
description: As a tenant administrator, you can use Microsoft Purview to search the audit logs for the actions Microsoft Defender Experts did in your tenant to perform their investigations
-[Microsoft Defender Experts for XDR](dex-xdr-overview.md)
28
+
- Microsofot Defender Experts for Servers
28
29
29
30
As a tenant administrator, you can use Microsoft Purview to search the audit logs for the times Microsoft Defender Experts signed into your tenant and the actions they did there to perform their investigations. You can also search the audit logs for the changes done by your tenant administrators to the Defender Experts settings.
-[Microsoft Defender Experts for XDR](dex-xdr-overview.md)
32
31
33
32
[Microsoft Defender Experts for Hunting](defender-experts-for-hunting.md) is a managed service that provides hunting capabilities for novel emerging threats that aren't yet well known in the industry. The analysts for the hunting service review trends in the threat actor evolution based on world-renowned Microsoft Threat Intelligence and Research. They then apply the insights they gather to hunt for emerging attack vectors within the customer ecosystem.
34
33
@@ -38,12 +37,14 @@ With deep product expertise powered by threat intelligence, we're uniquely posit
38
37
1. Get detailed, step-by-step, and actionable guidance from our experts so you can respond to these emerging threats.
39
38
1.[Seek assistance](#ask-defender-experts) from Defender Experts.
40
39
41
-
This document outlines the key infrastructure requirements you must meet and important information on data access and compliance you must know before purchasing the Microsoft Defender Experts for Hunting service. Microsoft understands that customers who use our managed services entrust us with their most valued asset, their data.
40
+
This document outlines the key infrastructure requirements you must meet and important information on data access and compliance you must know before purchasing the **Microsoft Defender Experts for Hunting - XDR**service and its add-on, **Microsoft Defender Experts for Hunting - Servers**. Microsoft understands that customers who use our managed services entrust us with their most valued asset, their data.
42
41
43
42
## Eligibility and licensing
44
43
45
44
Defender Experts for Hunting is a separate service from your existing Microsoft Defender products. Before enrolling in this service, make sure that you have the necessary license and access.
46
45
46
+
**Microsoft Defender Experts for Hunting – XDR**
47
+
47
48
We require the following licensing prerequisites to enable us to get started with this threat hunting service:
48
49
49
50
- Microsoft Defender for Endpoint P2 must be licensed and enabled on eligible devices
@@ -60,20 +61,33 @@ The following product is **not** covered by this service:
60
61
- Microsoft Defender for IoT
61
62
- Other Microsoft services not mentioned in the previous lists
62
63
64
+
**Microsoft Defender Experts for Hunting - Servers**
65
+
66
+
Customers who wish to have Defender Experts hunting coverage for Microsoft Defender for Cloud servers must have the following:
67
+
68
+
- Defender Experts for Hunting - XDR service enrollment
69
+
- Defender for Servers Plan 1 or Plan 2 in Microsoft Defender for Cloud
70
+
63
71
> [!NOTE]
64
-
> Licensing for Microsoft Defender Experts for Hunting is applied at the tenant level and all identities and devices will be included in your license.
72
+
> Defender Experts for Hunting coverage is applied at the tenant level and all identities and devices will be included.
65
73
66
74
### Defender Experts for Hunting coverage
67
75
68
-
Defender Experts for Hunting relies on event signals from Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps, Defender for Identity. It also relies on proprietary Microsoft Threat Intelligence sources.
76
+
**Microsoft Defender Experts for Hunting – XDR**
77
+
78
+
Defender Experts for Hunting - XDR relies on event signals from Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps, Defender for Identity. It also relies on proprietary Microsoft Threat Intelligence sources.
69
79
70
-
This service also covers servers—whether on premises or on a hyperscale cloud service provider—that have Defender for Endpoint deployed on them with a Microsoft Defender for Endpoint for Servers license.
80
+
This service also covers serversthat have Defender for Endpoint deployed on them with a **Microsoft Defender for Endpoint for Servers** license.
71
81
72
82
Any detection that's not from Microsoft Defender products (for example, detections from other security vendors) isn't within the scope of Defender Experts for Hunting.
73
83
84
+
**Microsoft Defender Experts for Hunting - Servers**
85
+
86
+
Defender Experts for Hunting – Servers provides add-on server coverage, including hybrid and multicloud servers from Defender for Servers.
87
+
74
88
### Ask Defender Experts
75
89
76
-
[Ask Defender Experts](experts-on-demand.md) is intended to provide a better understanding of complex threats affecting your organization. It focuses on products included in Microsoft Defender XDR (Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps, and Defender for Identity). [See sample questions you can ask Defender Experts](experts-on-demand.md#sample-questions-you-can-ask-from-defender-experts).
90
+
[Ask Defender Experts](experts-on-demand.md) is intended to provide a better understanding of complex threats affecting your organization. It focuses on products included in Microsoft Defender Experts services. [See sample questions you can ask Defender Experts](experts-on-demand.md#sample-questions-you-can-ask-from-defender-experts).
77
91
78
92
Defender Experts for Hunting customers are assigned 10 Ask Defender Experts credits, which you can use to submit questions, at the start of each calendar quarter. Unused credits from the current quarter roll up to the next one. You can use up to 20 credits only per quarter. All unused credits expire by the end of the calendar year or at the end of your subscription term, whichever comes first.
79
93
@@ -87,7 +101,7 @@ You might need certain roles and permissions to fully access the service capabil
87
101
88
102
## Service availability and data protection
89
103
90
-
Defender Experts for Hunting is a managed threat hunting service that proactively hunts for threats across endpoints, email, identity, and cloud apps. To carry out hunting on your behalf, Microsoft experts need access to your Microsoft Defender XDR advanced hunting data. Enrolling in this service means you're granting permission to Microsoft experts to access the said data.
104
+
Defender Experts for Hunting - XDR and Defender Experts for Hunting - Servers are managed threat hunting services that proactively hunts for threats across endpoints, email, identity, cloud apps, and servers. To carry out hunting on your behalf, Microsoft experts need access to your Microsoft Defender XDR advanced hunting data. Enrolling in this service means you're granting permission to Microsoft experts to access the said data.
91
105
92
106
The following sections enumerate additional information about the service's data usage, compliance, and availability. For more information about Microsoft's commitment in valuing and protecting your data, visit the [Trust Center](https://www.microsoft.com/trust-center/product-overview) then scroll down to **Additional products and services** > **Managed Security Services** > **Microsoft Defender Experts**.
93
107
@@ -99,6 +113,9 @@ Defender Experts for Hunting operational data, such as case tickets and analyst
99
113
100
114
Microsoft experts hunt over [advanced hunting logs](advanced-hunting-schema-tables.md) in Microsoft Defender XDR advanced hunting tables. The data in these tables depend on the set of Defender services the customer is enabled for (for example, Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, and Microsoft Entra ID). Experts also use a large set of internal threat intelligence data to inform their hunting and automation.
101
115
116
+
> [!NOTE]
117
+
> Microsoft Defender for Cloud is integrated with Microsoft Defender XDR. This integration allows security teams to access Defender for Cloud alerts and incidents within the Microsoft Defender portal. The Defender Experts for Hunting - Servers add-on service accesses data through the Defender portal, so the same data collection, usage, and retention policies apply to this service.
118
+
102
119
### Security and compliance
103
120
104
121
When you purchase and onboard to Defender Experts for Hunting, you're granting permission to Microsoft experts to access your advanced hunting data.
-[Microsoft Defender Experts for XDR](dex-xdr-overview.md)
28
+
- Microsofot Defender Experts for Servers
28
29
29
30
This document outlines the key prerequisites you must meet and essential information you must know before purchasing the Microsoft Defender Experts for XDR service and its add-on offering, Microsoft Defender Experts for Servers.
30
31
@@ -61,7 +62,7 @@ The following product isn't covered by this service:
61
62
62
63
**Microsoft Defender Experts for Servers**
63
64
64
-
To enable the Defender Experts for Severs coverage, Defender for Servers Plan 1 or Plan 2 in Defender for Cloud must be enabled. Endpoint protection should also be turned on for both Windows and Linux devices that allow protection powered by Defender for Endpoint, including automatic agent deployment to your servers, and security data integration with Defender for Cloud.
65
+
To enable the Defender Experts for Severs coverage, Defender for Servers Plan 1 or Plan 2 in Defender for Cloud must be enabled. [Endpoint protection](/azure/defender-for-cloud/integration-defender-for-endpoint) should also be turned on for Windows and Linux devices that allow protection powered by Defender for Endpoint, including automatic agent deployment to your servers, and security data integration with Defender for Cloud.
65
66
66
67
Depending on the coverage you're looking for, you can enable the Defender for Servers plan for a Microsoft Azure subscription, Amazon Web Services account, or Google Cloud Platform project.
67
68
@@ -78,7 +79,7 @@ We recommend ensuring that at least one product, such as Defender for Endpoint o
78
79
79
80
For maximum, native coverage, we recommend deploying the full Microsoft Defender XDR suite and enabling all eligible products in active mode.
80
81
81
-
Defender Experts for XDR also covers servers—whether on premises or on a hyperscale cloud service provider—that have Defender for Endpoint deployed on them with a Microsoft Defender for Endpoint for Server license. For Defender Experts coverage, a server is considered as a user account for billing.
82
+
Defender Experts for XDR also covers serversthat have Defender for Endpoint deployed on them with a **Microsoft Defender for Endpoint for Server** license. For Defender Experts coverage, a server is considered as a user account for billing.
82
83
[Learn more about specific hardware and software requirements](/defender-endpoint/minimum-requirements)
-[Microsoft Defender Experts for XDR](dex-xdr-overview.md)
28
+
- Microsofot Defender Experts for Servers
28
29
29
30
Microsoft Defender Experts for XDR provides you with multiple channels of communication to discuss incidents with our experts, ask them questions on demand, or get service readiness or operations support from your service delivery managers (SDMs), if included in your service.
> Microsoft Defender Experts for Hunting is sold separately from other Microsoft Defender XDR products. If you're a Microsoft Defender XDR customer and are interested in purchasing Defender Experts for Hunting, complete a[customer interest form](https://aka.ms/DEX4HuntingCustomerInterestForm).
32
+
> Microsoft Defender Experts for Hunting is sold separately from other Microsoft Defender XDR products. If you're a Microsoft Defender XDR customer and are interested in purchasing Microsoft Defender Experts for Hunting - XDR and the Microsoft Defender Experts for Hunting - Servers add-on, complete this[customer interest form](https://aka.ms/DEX4HuntingCustomerInterestForm).
33
33
34
34
> [!NOTE]
35
35
> Any incident response services offered by Defender Experts will be offered under the Defender Experts Service Terms.
36
36
37
-
Microsoft Defender Experts for Hunting was created for customers who have a robust security operations center but want Microsoft to help them proactively hunt threats using Microsoft Defender data. Defender Experts for Hunting is a proactive threat hunting service that goes beyond the endpoint to hunt across endpoints, Office 365, cloud applications, and identity. Our experts will investigate anything they find, then hand off the contextual alert information along with remediation instructions, so you can quickly respond.
37
+
Microsoft Defender Experts for Hunting was created for customers who have a robust security operations center but want Microsoft to help them proactively hunt threats using Microsoft Defender data:
38
+
39
+
-**Microsoft Defender Experts for Hunting - XDR** is a proactive threat hunting service that goes beyond the endpoint to hunt across endpoints, Microsoft 365, cloud applications, and identity
40
+
-**Microsoft Defender Experts for Hunting - Servers** is an add-on to Defender Experts for Hunting - XDR, providing proactive threat hunting for hybrid and multicloud servers
41
+
42
+
Our experts will investigate anything they find, then hand off the contextual alert information along with remediation instructions, so you can quickly respond.
38
43
39
44
The following capabilities included in this managed threat hunting service could also help with your daily SecOps work:
-[Microsoft Defender Experts for XDR](dex-xdr-overview.md)
28
+
- Microsofot Defender Experts for Servers
28
29
29
30
Microsoft Defender Experts for XDR offers scoped coverage for customers who wish to have Defender Experts cover only a section of their organization (for example, specific geography, subsidiary, or function) that requires security operations center (SOC) support or where their security support is limited.
0 commit comments