Microsoft Defender for Cloud Reviews

XDR protects our endpoints, but our cloud applications lack this security measure. Microsoft Defender for Cloud provides some protection by monitoring SharePoint and our internal cloud applications for malicious activity.

Recently, there was a widespread cybersecurity incident where systems issued by companies were controlled by insider threats from North Korea and China. Defender for Cloud Apps helped us find associated applications and appropriately tag them.

The range of workloads covered by Defender for Cloud has been satisfactory. As a small organization with a limited number of workloads, the current offerings are sufficient. Our information security office consists of six or seven people, with an additional one or two individuals assisting with SecOps tasks. While the current setup is adequate, a larger organization would likely utilize the diverse workloads and permission sets available.

Defender for Cloud provides a prioritized list of security issue remediations. However, we often find that many items are false positives or not as critical as Defender assesses them to be. Therefore, we manually curate the list to better align with our security priorities.

Our Defender for Cloud platform is integrated with the majority of the Entra and Microsoft 365 suite, including hybrid cloud identity, Entra ID, Azure Virtual Desktop, and SharePoint.

Microsoft Defender for Cloud has significantly enhanced our overall security posture by approximately 20 to 25 percent. It extends beyond our XDR, encompassing all our cloud-based data within SharePoint, Entra, and similar services, thus providing comprehensive protection.

Protecting our hybrid and cloud environments is essential. While Defender is a valuable security solution offering solid benefits, it's not the only option available. Other solutions could effectively fulfill this role, making Defender important but not uniquely critical.

I am closely dealing with alerts related to cloud workloads. We are integrating the alerts that pop up for different services to analyze the gaps in our Azure landscape. We then assess what we need to close and what makes sense for our environment because not everything is applicable. It depends on our company's requirements as well. We plan the strategy for how to close those gaps. There are different mechanisms for how you deal with those security alerts.

We are using the Microsoft Azure Security Benchmark along with the CIS Benchmark. We rely quite heavily on these benchmarks, and I would rate the CSPM functionality a nine out of ten. Most recommendations are focused on generic security gaps, but overall, those recommendations are very good from the security aspect, irrespective of the industry.

It is pretty good in terms of the range of workloads covered. It covers most of the IaaS infrastructure that Azure offers and most of the PaaS services that we are using. I cannot recall any service that we are using for which Microsoft Defender for Cloud does not have recommendations.

We have integrated the alerts that we are getting from Microsoft Defender for Cloud with our on-premises Splunk solution. We capture those alerts. They are integrated via Microsoft Events Hub. It acts like a queue and pulls those alerts from Microsoft Defender for Cloud and then sends them to Splunk. This integration helps our global security team to figure out which alerts are critical. They can then reach out to the owner of an asset.

Microsoft Defender for Cloud helps in improving our overall security posture. We have a nice overview of what is missing where and what can be improved.

Without Microsoft Defender for Cloud, we will not have any visibility into our security posture. The way on-premises things work in our company is complex. We have ten different tools for ten different categories. We have one tool for vulnerability assessment and one for patch fixing. Microsoft Defender for Cloud is a single integrated tool. It gives me a holistic overview of my whole security posture.

At the moment, we work with Sophos, SentinelOne, or Microsoft Defender. Most of our customers have Microsoft infrastructure, and they are cloud-only customers with Microsoft business licensing. I primarily recommend Microsoft Defender for customers who already have Microsoft infrastructure.

The most valuable feature is the hunting feature, which integrates well into the entire Microsoft ecosystem. It allows customers to have all security settings in one panel, providing a unified admin site. This feature significantly aids in threat detection and enhances the user experience by streamlining security management.

We use Microsoft Defender for Cloud to secure our environments across the company. We have the full E5 suite, including Microsoft Defender for Identity and Endpoint. The solution integrates the total spectrum of Microsoft products. 

We are not a multi-cloud environment. We're entirely on Azure. It's not a hybrid environment. Defender only covers the cloud, and we have a different solution for our on-prem environment. 

Microsoft Defender for Cloud has made our environment more secure. We don't have to worry about it as much, and we've never had a breach, giving us a lot of peace of mind. We've improved our security posture because Defender extends the capabilities of a whole range of products, so we don't have any gaps.

We are a multi-service provider with various clients. We recommend Microsoft Defender for Cloud to clients who have an Azure environment. We advise them to turn Defender on to protect all Azure resources, such as IaaS servers and SQL servers and ensure our clients follow the best security recommendations.

Microsoft Defender for Cloud provides us with all security-based advantages. Getting visibility into our vast and rapidly changing cloud environment is challenging in day-to-day operations. This solution gives us a single pane of glass to view everything involved in security.

Defender for Cloud has improved our security poster by at least 100 percent. We did not have security before that. It's our primary way to protect our hybrid environment, so it's critical to us. It's also crucial to our coordinated detection and response across all our workloads, and we leverage Sentinel with Defender for Cloud.

We use Microsoft Defender for Cloud primarily to scan storage buckets and ensure no sensitive data, such as PCI or PII data, is present. We also use it for general resources, including resource groups, storage accounts, and Azure Key Vault.

We don't use it for detection and response. It's more for scanning architecture and data to ensure we have the latest infrastructure configuration. I don't think we're using it for Entra ID. Another team does that. I'm more on the operation side. 

Defender works in tandem with Wiz, so we get insights and email alerts if something isn't compliant. For example, we get an alert if TLS 1.2 isn't enabled. It keeps track of what's compliant and what isn't. 

We have deployed Microsoft Defender for Cloud to identify vulnerabilities across various log sources for our client.

We implemented Defender to improve the security posture of our client's landscape.

The single pane of glass that Microsoft offers is highly crucial for several reasons. First, aggregating multiple log sources into a single pane of glass is not achievable without Microsoft Defender for Cloud. Second, we also interact with other cloud environments.

We use Defender's free CSPM functionality for the Microsoft Cloud security benchmark. The benchmark recommendations show all the vulnerabilities that help us to create a remediation plan and to take action.

It is a necessity for us that the free CSPM functionality provides multi-cloud monitoring and posture management because most of our workloads are spread across multi-clouds.

The comprehensive range of workloads protected by Defender for Cloud is sufficient for our needs, as it encompasses all essential security pillars.

We have enabled Defender for Cloud's native support for GCP. A key requirement for us before selecting Defender for Cloud was that it supported other clouds.

Defender for Cloud has aided in reducing the number of vulnerabilities and expediting the resolution process, thanks to its helpful suggestions. Consequently, we have achieved remarkable time savings of approximately 30 to 40 percent each week in comprehending and addressing vulnerabilities.

By integrating Defender for Cloud with the firewall and Defender for Endpoints, we have gained comprehensive security insights through these Microsoft integrations. This unified approach provides a single pane of glass for viewing all security information, eliminating the need to navigate between multiple portals.

Defender for Cloud has improved our security posture.

The unified monitoring has saved us around 30 percent of our time.

Defender for Cloud has increased our security team's efficiency by 30 percent.

Defender for Cloud is a unified platform. Within that, you have Defender for virtual machines, Defender for Servers, Defender for App Services, and Defender for Containers. It is a centralized solution, which you can leverage to bring your security practices in place so centralized security auditing can be done. 

You can use it for approximately 90% to 95% of Azure workloads for infrastructure, platform as a service, or database as a service. You can use it for all these.

I am working for a service-based company. We provide Azure Cloud Services. We are a Gold-Certified partner from Microsoft in the GCC region. We are the only ones for whom Microsoft hands over their business. 

We mostly use it for public cloud, but it can also be used with hybrid cloud and on-premises. We also use private clouds with government entities.

We have had many customers where we deployed this solution. They are secured and guarded by this solution, so they are happy now.

It can be done as a multi-regional deployment.

It can be used to secure GCP, AWS, and your on-premise infrastructure. You need a security solution like Defender to secure any type of workload. Your workload may consist of infrastructure, platform, database, or anything in between those. Obviously, you want it to be secure from day one. When you start from anything on the cloud, you want it secured right away. If it is not secured, then you are at risk of a data breach. There are many security issues, which is why it is important to secure your application infrastructure from day one. This is 100% important.

Most customers have an on-premises ITSM solution. If they want P1 or P2 tickets to be initiated, then within Defender for Cloud, it will trigger the ticket or invoke the ITSM solution. Also, they can use SMS- or email-based ticketing. If they don't have anything, then they can utilize the dashboard provided by Defender for Cloud and get everything from one place.

If you don't have this solution then you will be analyzing things with some sort of algorithm or writing some code, then your team will be monitoring emails or some kind of logs every day. When you have commissioned Defender, you have these things visible already on your dashboard. This gives the efficiency to the people to do their actual work rather than bothering about the email, sorting out the email, or looking at it through an ITSM solution, whey they have to look at the description and use cases. Efficiency increases with this optimized, ready-made solution since you don't need to invest in something externally. You can start using the dashboard and auditing capability provided from day one. Thus, you have fewer costs with a more optimized, easier-to-use solution, providing operational efficiency for your team.

Within a SOC team, you monitor tickets and emails, but you cannot automate them unless your company bought some solutions. In the case of Defender, a solution is already provided. You just need to extend it per your needs.