Microsoft Defender XDR Reviews

We use the standard Microsoft services and solutions for our entire IT infrastructure, so we leverage most 365 Defender services, including Sentinel, Defender for Identity, Defender for Endpoint, Defender for Cloud, Defender for Cloud Apps, and Defender for O365. We use all those solutions to secure our IT infrastructure and environments.

We deliver Microsoft services to users worldwide, including SharePoint and Exchange Online. Gmail is the one minor exception where we do something slightly different. 365 Defender currently covers 5,000 endpoints and between 10,000 to 15,000 identities. There are more identities than endpoints because we don't give everyone a company laptop. 

A larger organization absorbed my company that moved to Microsoft security products a little while ago, so it was natural to do the same at my company. The biggest benefit of going with Microsoft is that it's a huge company with lots of resources to put into security.

Most devices use the Microsoft's operating system and products these days. They get a lot of data from all those users, which helps them stay ahead of the competition. They process a few billion security-related signals daily, helping them deliver a better solution to us.

Introducing 365 Defender and Sentinel was the best decision we ever made. Many organizations have most of these components in place but aren't effectively leveraging them. 

They might be using a managed services provider that forces them only to use products from their partners. Still, they have an enterprise license with Microsoft that includes Microsoft Defender for Endpoint, which is part of the 365 solution. I think it makes more sense for people to use Microsoft security solutions too.

We can automate security tasks to a degree. There are several automation options, but it depends on the definitions of analytics rules, queries, etc. Microsoft provides many of those in its out-of-the-box catalog with many additional third-party queries that you can use. You can fully automate things as soon as you have your queries defined. Getting there might be a little difficult. 

Microsoft 365 Defender saved me from looking at multiple dashboards. There are still separate dashboards for Sentinel and 365 Defender, but the same alerts and incidents are generated on both consoles. The only difference is that 365 Defender won't show you anything you've customized on Sentinel. 

There is a separate Microsoft-specific intelligence dashboard that Microsoft keeps up to date. As soon as there is a specific threat that may affect our organization, it shows up on the dashboard, and we can see the sources of the attack, the path, and all the other information you need. It's useful, but I don't think our security operations center is using it. They only rely on third-party threat intelligence resources. 

We've saved time using 365 Defender because rolling it out is easy. The hardest thing is pushing it out to all the devices you are managing. Using a third-party device management solution might be slightly more complicated, but it's straightforward within the Microsoft ecosystem. 

I'm not sure how much money we've saved overall, but they previously used McAfee EDR for antivirus, which was costly. Most of our existing solutions are Microsoft, so we were already entitled to use Microsoft Defender for Endpoint. We weren't using Microsoft security solutions because someone decided they preferred McAfee many years ago. 

The McAfee contact was around a few million, and the full Microsoft enterprise license was also a few million. Using the security solutions bundled with the Microsoft license probably cut our costs in half.

It's hard to say how much our detection and response time decreased because we didn't have a comparable solution. Instead of going to a portal for McAfee or making Splunk ingest all kinds of profiles, we could dump all the data into a more analytical tool to get all these alerts.

Having a single pane of glass for all Microsoft security services makes everything much easier. A security analyst can go to a single portal and see everything in one view. The integration of everything into one portal is a huge benefit. 

Defender provides a lot of detailed information about your environment. It may be challenging for people without much experience to get the data they need because it can also be overwhelming. At the end of the day, Defender gives you almost all the information you need for anything you want to do, and Microsoft is working to extend that further. Some areas may not be fully integrated into 365 Defender yet.

There's also a vulnerability management feature. It installs an agent on all your devices to check where you're vulnerable, so you can resolve the issue. Once you get hit by an attack, you can disrupt the attack using an advanced AI.  

We use all of the Microsoft security solutions. They do an excellent job of making it simple to integrate the security features. It's easy if you have a little experience, and there is a lot of documentation if you are entirely new. 

The various Microsoft solutions work seamlessly together, especially the Sentinel part. Attack disruption is almost fully automated.

Sentinel can ingest data from our entire ecosystem with some additional work. Technically, you could ingest anything. It would be easier if there were an out-of-the-box way to integrate it, which already exists for many components. However, several third-party products do not have out-of-the-box connectivity, so you may need to do some fairly complex work. On the other hand, it is relatively simple to ingest data from most big-name products.

Sentinel enables us to investigate and respond to threats from one place, which is essential because IT environments are increasingly complex. There are so many servers, cloud services, applications, etc. Using multiple portals to view security incidents doesn't work anymore. 

You still need to configure Sentinel to ingest data from other third-party solutions, but much of the data is readily available if you primarily use Microsoft products. There's a lot of overlap between Defender and Sentinel, but as soon as you go outside the Microsoft domain, you must start using Sentinel. 

Sentinel is comprehensive. It stacks up well against some of the other big names in the SIEM space. Microsoft plans to add even more advanced features like behavioral analytics. AI is a huge topic right now, and Microsoft is ahead of the curve compared to other solutions in the security quadrant.

It already integrates natively with the Microsoft ecosystem, but there is still room for a minor improvement in third-party integration. Another issue is that the portal is sometimes less intuitive than you would like. That's probably because they're consolidating various security products, and there are a few legacy things left over that complicate matters in some cases. 

Still, if you gave someone who works in security access for the first time, that person would be impressed and wouldn't have any specific complaints. You only start to notice a few small things once you used them for a while, but nothing is significant. 

Microsoft 365 Defender combines several Microsoft solutions, and I used the component solutions of 365 before they were consolidated into one solution. For example, I started using Defender ATP four years ago, but I've only used 365 Defender for around three years.

Overall, the stability is top-notch.

I haven't seen any limits to 365 Defender's scalability. I don't know if you would have issues once you start adding 200,000 endpoints. There might be some glitches here or there. Scalability seems to be an area where Microsoft's cloud solutions excel. 

I rate Microsoft's support a four out of ten. Support is hit or miss. Microsoft wants you to buy premium support contracts. Though they call themselves professional support, it's almost like throwing questions into a black hole. You get an answer, but it's never helpful. 

If you invest in what they call "Unified Support," it's slightly better. You get good answers quite often, but it sometimes takes a long time. They should be going to the public group to discuss technical features, and they don't do that.

In some cases, their answers make no sense. I recently caught a support person making a statement I knew was incorrect, so I had to go back to somebody in the product group at Microsoft to get them to confirm. In my opinion, it's better to invest in a support partner. These companies specialize in this. They might know a fix or shortcuts to get high-level support. Their IT department may have contacts with people in Microsoft's public group, so they can get answers faster. 

Neutral

Before my company was acquired, we used a few solutions, but they also started drifting toward Microsoft in the last year. They were also shifting from third-party solutions to Microsoft solutions. They used McAfee for endpoint protection and eventually switched to Carbon Black. 

If you asked me five years ago if I would recommend a Microsoft security solution, I probably would have said "No," but they've come a long way in a short time and made a lot of investments in that area. Seven years ago, I would also have chosen something like McAfee or Carbon Black.

365 Defender is a cloud-based solution, so you don't plan and deploy the individual components like a traditional endpoint solution. You have components installed on-prem, like the firmware for endpoints, and you run Lambda for Cloud on your servers, which may be in the cloud. We also have servers hosted in a Microsoft. Our environment combines multiple things. 

I was primarily responsible for the deployment. I found it mostly straightforward, but I also have experience and a Microsoft expert certification on many of these topics. If you've never done this before, the good news is that Microsoft documentation is excellent. It gives you all the steps that you need to take. But then it will take you a bit longer to follow the instructions. I can almost do this with my eyes closed, but it will take a lot longer for someone new to this. 

If you have some experience, you could theoretically set this up in a few days. It wouldn't be completely deployed because you may need to write several analytics rules in Sentinel, depending on your environment. The integration with Microsoft apps is one click.

I did the planning, but our IT partner did the hands-on work. The design stage took a little longer here. We discussed which features to enable and which might cause our users too many problems. That process took about two or three months. The actual deployment was finished in a few weeks. The only limiting factor was that we needed to ensure all the endpoint software was installed, which took some time. 

After the deployment, there is a little maintenance, but it's pretty automated. We need to be extra careful in some areas. Microsoft often releases new features that replace and disable existing features. Administrators may need to go into the various services and change settings. You also need to push updates to the endpoints. 

Microsoft does this automatically, but you can use a device management solution. How often do you want to do this, and how quickly? Do you want to delay specific updates to the antivirus engine for testing purposes? 

For example, Microsoft messed up about four months ago when they pushed out an update automatically to all the global endpoints. Depending on our settings, it causes certain file types to be seen as malicious and deleted from user devices. 

For example, it was deleting shortcuts. You can imagine if you came into the office on a Monday morning, and all the shortcuts have been deleted. It might make sense to test the updates to ensure they're working. You have many options to manage this, so it's flexible in that sense. It's just a matter of your organization's cybersecurity priorities. 

Microsoft customers can opt into server health notifications. You get a lot of notifications, but they may not affect your organization, and not all of them are serious. 

365 Defender can get expensive because you pay per gigabyte of data ingested. On the other hand, much of the data available in the other Microsoft security solutions are made available relatively cheaply—sometimes at cost or for free. Integrating only a limited set of third-party solutions with Sentinel would be cost-effective. It's much more affordable if companies only have Microsoft solutions. 

Data ingestion and log storage costs are relatively expensive, and you also need to consider the labor investments in fine-tuning all the analytics rules, etc. However, those costs will be similar to any product.

Microsoft licensing is highly complex, so you must carefully pick the license you need. People tend to choose the cheapest license or take a more expensive one to ensure that all possible features they need are covered. The price difference between those two options is vast. 

Some of these services are there without a license. That's problematic because the Microsoft agreements state you must license them. You might assume that you can use it. There are no restrictions in some cases, so some companies may have a problem. If Microsoft finds out, they'll get stuck with a bill because they were using something without a license. 

I rate Microsoft 365 Defender a nine out of ten. Microsoft is doing extremely well, and they plan to add a lot of new features, which is going to be exciting for many people in the security area. 

I always recommend a proof of concept, but I believe you'll be fine if most of your environment is Microsoft. These solutions also support Apple hardware, so that shouldn't be a problem either. If you're entirely using Microsoft products, I would say it's a no-brainer, especially if you are already invested in a Microsoft 365 license.

At the same time, Microsoft's licensing is extremely complicated, and there are several different licenses that go up in price quickly. You might need a licensing consultant because they know the details. You could also go in the opposite direction there. Somebody might try to sell you the most expensive Microsoft plan because they believe you need it, but you lose money if you're not using it.

Security 101 tells you, "Don't bet on a single vendor." I agree with that on a certain level because what happens if Microsoft gets compromised? But on the other hand, the native integration you get from using Microsoft security solutions is worthwhile. 

I've had this conversation with my CEO at some point. They raised the question of what would happen if Microsoft were compromised. I told them that Microsoft is one organization, but each of these product groups acts like its own startup in the sense that there is a subset of infrastructure devoted to each. If one part of Microsoft is compromised, it does not mean the whole of Microsoft is compromised. I always tell people to let go of that principle, but I understand the desire to introduce additional tooling. 

Public Cloud

Microsoft Azure

We provide MXDR services. Initially, they are professional services such as setup and deployment, and then after that, we provide Day 2 services, which include working on the incidents and alerts the products generate, determining which one is a true positive and which one is a false positive, taking response actions, and maintaining a steady state.

We are expanding use cases with Defender for IoT integration. Now that the E5 license includes the enterprise IoT sensors, we are getting more of that telemetry to our SOC. Because most SOCs do not have that telemetry, it is something that we have had a couple of clients invest in. 

In terms of our in-house usage of this solution, there is not a lot of in-house infrastructure when it comes to workstations and things like that. As a security company, we are pretty infrastructure-light.

It helps with the well-rounded investigation where it does the automated investigations and does a lot of enrichment for you, so the SOC analyst does not have to play run and go fetch as much. They can go deeper into an investigation in a shorter amount of time.

It does not necessarily provide unified identity and access management. Most of that comes from Entra ID, but it absolutely provides security visibility. For identity protection, the combination of Azure Identity Protection and Defender for Identity in the same place is the most powerful part because it is your on-prem identity world and your cloud identity world. Those two things are connected in most environments. Most of the people who have issues or most Microsoft customers have hybrid environments. That means they have two IMs and a bidirectional trust. One is the old-school one, which is Active Directory, and that lets everybody in with a username and password, whether you are good or bad, and then the newer one is the one that has conditional access, and that is Entra ID. Most corporate environments have both, so you have all of the weaknesses of both systems in one nice little package. From a defensive monitoring standpoint, we get a lot of cases, and most clients have that situation. Most clients that we see for incident response, and who are dealing with whether they are going to have our business online tomorrow, are in that hybrid situation.

In terms of covering more than just Microsoft technologies, most of 365 Defender is focused on its own technologies. There is that extensibility to be able to bring in threat indicators. The Zeek integration in Windows provides a lot of functionality, but most of the time, when we are getting that third-party signal, it is via a SIEM. That is where we go look for that third-party cross-correlation signal. The XDR signal is in that 365 Defender portal, and using things like custom detections is helpful there, so you can do SIEM-like functionality, but not on a third-party data set. This third-party correlation is the logical place for Sentinel. Some of the federated search between the two and being able to see both datasets in both places relieves that pain. The vast majority of our MDR clients are using 365 Defender and Sentinel, but there are definitely people who have E5 licensing but still have QRadar, Splunk, or something like that. Sometimes, we have somebody who starts with just 365 Defender but has a Sentinel adoption plan because they have a year left on their QRadar contract. The cool part about Sentinel is that it is software as a service, so you can start small and then add to it. You can start with what we call Sentinel Light, which is basically just the free data connectors. A lot of times what people do is that they have E5 licensing in their contract, and they start with 365 Defender. They then start with free data sources in Sentinel and incrementally add server logs or Palo Alto logs as their budget allows them.

365 Defender has enabled us to discontinue the use of other security products. There is always realization in terms of whether we still need, for example, Tenable agents with 365 Defender TVM. The answer is probably not. Normally, it is building out that process where we are going to remove Tanium because we now have Intune, so everybody has that adoption roadmap. Typically, you go for the things that create the least amount of friction when you are going through that adoption roadmap and you save the things that are going to be painful, such as DLP, for the end. It is always about dollars. When it comes to security budgets, potentially, you are replacing five to six line items on your security budget with one. I have been getting extra functionality on top of it for Teams and things like that. When you make the business case to the decision-makers and you get all of the information at the table, it is normally a pretty overwhelming case.

The savings depend on what their actual spending is and how many other security vendors they are purchasing. For most information security professionals, half of their day goes into vendor meetings and maintaining those vendor relationships. You have active relationships, contract relationships, etc. You have all these different relationships, and you have to go out to their conferences, their dinners, and things like that, so you end up dealing with vendors all day instead of actually doing the work. There are two types of costs. There is that hard cost, which is pretty easy to define, and there is also that soft cost of what if you had this common security fabric that you could take, customize, and then add to it. That is what the Microsoft security play is. Instead of bolt-on security, it is built-in security, and then you can still add to it. You can still add custom tools like Velociraptor and all the other tools that complement the Microsoft security suite, but what you do not have to do is play with vendors all day and do the bolt-on security play, which is, "Install our agent and everything will be good. There will be 99% ransomware protection." That is not how real life works.

It saves time and brings operational efficiency. As threat hunters, looking for an initial compromised assessment, going into a SIEM, and looking through a SIEM can take a lot of time. With 365 Defender, I can run four or five queries on you, and if they light up, I know you have problems. If they do not light up, you are probably alright. It is about being able to get there relatively quickly and assess the situation. Should we go ahead and send out the notice and call the general counsel, or is this just a little thing we need to run down and keep traps on? The time saved depends on where they are coming from. If it is a relatively old school company that has got an old school SIEM, and then they have a next-gen antivirus and a separate EDR solution, they could be doing 100% manual investigation, so it is saving them 300% because the chances are that they were not even investigating all their alerts. 

The ability to hunt that IM data set or the identity data set at the same time is valuable. As incident response professionals, we are very used to EDRs and having device process registry telemetry, but a lot of times, we do not have that identity data right there with us, so we have to go search for it in some other silo. Being able to cross-correlate via both datasets at the same time is something that we can only do in Defender 365. We do not get it in the other products.

From an integration standpoint, it is always improving overall. With Security Copilot coming out, as partners, we are waiting for the GDAP support so that we can actually see Security Copilot on behalf of customers if they subscribe to it. I assume that will happen in the next couple of months, but there have been smaller improvements like that. I started with the Defender ATP product back in 2019. In terms of where it started versus where it is now, it is very different. A lot of the automated defense capabilities for auto-remediation and the threat and vulnerability management features that are coming out are the most exciting because they answer that CISO question, which is, "How covered am I for ransomware?" Most of the time when people answer that question, it is a very generic answer. They can look at the top twenty methods that most ransomware groups are going to use to see how protected they are, but they are probably not going to do that well, or they are pretty secure, and they are probably going to do pretty well. It gives more of that real-world experience that most people do not have. 

We have been using this solution for about four and a half years.

From a partner standpoint, typically, we do our best not to contact support. We are very sensitive about how we spend our time. The more time we burn on something, the less profitable we are. Normally, playing kick-the-ticket-around in any support organization does not help, so most of the time, our engineers can arrive at some type of solution without engaging anybody else. If we do have a hard blocker that is well-defined and well-documented, we typically escalate that through the product team and not through the support channel because the more time we spend on the phone with support, the less we believe in our overall relationship, so we just avoid that activity, and we feel good about the relationship.

We definitely have had some major instances with large customers where something bad was happening and they needed immediate resolution, but they did not even get a callback for 48 hours. When you are in the middle of that relationship just doing the SOC servers, you wonder why you are getting 300 attack alerts in an hour. You then escalate and call everybody inside of Microsoft. You blow up the horn right on Friday because these things always happen on Fridays. It is a bad situation for everyone. The one thing that I have learned especially with MDE is that most of the time, the people who can fix your issues are in Tel Aviv. A lot of times, if I put an entire well-documented explanation together and drop it in Teams to somebody, I will get a response at 2 AM, so the next day, I will check my messages first thing, and a lot of times, it is like, "That issue is fixed now." I know where I need to go when I need to get things solved, but calling any help desk, including our own internal help desk, does not work. 

In the right context, Microsoft's support can easily be a seven or an eight out of ten adventure. In the wrong context, it can easily be a two or three adventure. It is like rolling the dice. Sometimes they come up with snake eyes, so it is all about expectations.

I also deal with Azure a lot because most of the time, I am responsible for our backend systems. We are rebuilding our entire platform in Azure. We did a greenfield build, so I am teaching a lot of Java developers on Azure. Their default answer when something does not work is that Azure is broken. I know that Azure is not broken. They are doing it wrong. I then show them, but their general thought is, "Why don't we just open a ticket with Azure support?" My response is, "Why do you want to wait three hours for them to tell you the same thing, which is, that you are doing it wrong?" A lot of it is engineers learning. If they have the appropriate exposure and investment in education, it helps with digital transformation, but it also helps with security transformation. A lot of times organizations buy things and then tell their engineers to implement them. Nobody bothered to send them into training first, so they are doing their best with the information they have. They did not send them to Microsoft Ignite. They did not send them to any of the great local resources. We have all these different meetup groups where you can see the difference in people. You get to know who is succeeding with Azure or succeeding with Microsoft Security. When you get stuck, you know whom to call and ask how to do something because you are not able to figure it out even after wasting six hours. You can ask them to at least point you in the right direction. That is a better solution than calling an 1800 number because it is going to be more focused and more prescriptive.

We support a couple of other security vendors as well, which always gives us a great comparison to how they are doing. It is the difference between holistic security and non-holistic security. You get one set of data. It could be a good set of data, but it is not mixed with the other data points. When you got an email alert here, and then you got an identity alert, and then you got an EDR alert, and then you got the domain controller alert, you can go through that entire kill chain versus those separate technologies. With separate technologies, you are going to spend an hour and a half putting that story together, and chances are they are already on ten different servers by now, so you are behind the gun. You know the story, but now, you have a bigger story because it just blossomed over there.

In terms of comparison, there are quite a few other XDR products, and all of the XDR products suffer from the same kind of challenge, which is—they are only as good as the data they have available. For instance, if you are a 365 Defender shop, but you are using Okta, a lot of that identity information is not flowing through 365 Defender. It is flowing through Okta, so it is 60% to 70% blind. Trend Micro has its XDR solution, but if you do not have all the things deployed, and you only have 30% of the things deployed, you are looking at 30% percent of the data. That is one of the key components. When we deal with an IR situation, we have a lot of people who are like, "We have E5. We deployed Defender for Identity. We deployed Defender for Endpoint to some of the endpoints, but not all of these servers yet because that is scheduled for next year." In such scenarios, we have limited visibility. We can see certain things, but those other alerts tell us some other things are going on on some endpoints that we cannot see. That is the situation that you have to solve rather quickly, so halfway-done deployments are the issue. When we see them, we know why they are calling us because it was always bound to happen. It is then that classic situation where they will have to do it all in two days on Saturday and Sunday. They will have to completely redo it and finish off that deployment because this is what they needed to do for threat eradication.

I have helped clients deploy it. I have helped a little bit with the internal deployment. We do not have that much infrastructure. Most of our infrastructure is containers, and 365 Defender does not come into play. That is mostly the Defender for Cloud Storage.

In terms of the time it normally takes for different users to get fully deployed and functional with the solution depends on the users and the infrastructure. Those are two different things. For humans, typically those enablement sessions can go in a matter of weeks, and then it is also a matter of the client investing some of their own time in their own lab and things like that because you are never going to learn a tool unless you get hands-on with it. Watching me work on it is not going to teach you that much. You have to work on it, and then because Microsoft security is a holistic security and not a bolt-on thing, you are also dealing with some tech debt at the same time. If they have had 2012 servers and they have not updated those servers in eight years and there are no security patches, you will have to resolve some of those dependencies before you can onboard those servers to Defender. It is not Defender's fault. They should have been patching those all the way anyway. That is according to the best practices, but they were not, so now you will have to wait three weeks for the server team to update these and then you onboard them to Defender. Every corporation has different change controls. If it is a small corporation with only four or five thousand endpoints, there are probably three or four guys who can pretty much do whatever they need to do. A big corporation with a hundred thousand endpoints will have to put that through change control and then four people have to sign off in blood. It is a much bigger thing and lots of paperwork has to happen.

Normally, a good accelerator project takes three to four weeks. That includes going through the basics, making a deployment plan, doing a test group, and then validating that all of those policies are going to work in the environment. One of the big advantages that changed just in the last year is the built-in configuration management. When I initially started with 365 Defender about four or five years ago, we had a problem where a lot of people would run the onboarding packages but forget to deploy the policy, so it did not work as well as it could. The difference those other platforms had was that they had built-in policy management, so you make your settings and apply them to your group of endpoints, but now, it is there in Defender. Previously, with Defender, we had nine different ways to do it, such as configuration manager, registry, and PowerShell, and clients struggled with that because none of the options were perfect for all their endpoints. With the built-in configuration management, you have that feature parity now. You can do built-in policy management for Windows, Mac, and Linux endpoints, and that speeds up deployments. As the deployment engineer, you do not have to say, "Here is the list of ten different options. Let us select which one is going to work for which group of devices." Now you can just say, "We have a good solution. It is probably going to work for about 99% percent of your devices. You might have a few offline servers or old Linux servers. We will have to do a slightly different custom solution for them, but we have a 99% solution. Let us go ahead and get started on it," and that is very good because you do not necessarily lose the room when you are explaining it to your security team members who never had to do something like that. You can just say, "We have a solution here, guys. We are good."

When we go through all of the information security training, typically, we are trained on other systems, so there is a learning curve for most information security professionals. If there is executive sponsorship to say, "We are going to invest in learning our Microsoft security tools so that we get maximum bang for our buck out of them," that typically goes very well. Microsoft has programs, such as accelerators and the ESIS programs, that enable partners to guide that mission. 

Our deployment engineers have done the Sentinel and 365 Defender deployments for four or five years. They work on these projects all day and every day. A lot of time, they are just helping other people who are doing their first project and saying, "Oh, you probably do not want to load it on these servers.", or "This is the shortcut for this issue." They are just guiding them on that process and helping them avoid some of the mishaps and things that people normally struggle with. Once you get them fully deployed, the ROI starts showing up daily. It is just a matter of getting them to that steady state versus that halfway-done state because a halfway-prepared defense never performs well in combat.

I would rate 365 Defender a nine out of ten. It is a very powerful tool. My favorite gig is explaining it to other incident response professionals and saying, "Now that the customer has an E5 license, and this is all deployed, let me show you this. You run this query, and you bring all of this stuff back. This is how you create custom detections that will automatically isolate things if anything jumps off on this device." I can explain that in a two-hour crash course. If you can explain it the right way to other professionals, they end up realizing how powerful it is. It works great.

Our primary use of Microsoft Defender XDR is for threat hunting and monitoring potential threats entering through email and URLs. We use the full suite, including Defender for Endpoint, Defender for Office 365, and Defender for CloudOps, especially now that we have upgraded to M5.

Microsoft Defender XDR has significantly improved our operational security. We've observed a notable decrease in click rates since implementing attack simulations, and the overall response to these campaigns has been positive.

Since activating the M5 feature set, we have observed a decrease in malicious clicks and faster incident alerts.

The Email Explorer feature has proven invaluable, offering a broader perspective than automated alerts and incidents alone. Its comprehensive view has simplified the process of targeting and identifying specific threats, including those initially missed but subsequently flagged, enhancing our overall threat detection capabilities.

Microsoft Defender XDR could be improved in terms of speed, especially backend speed. Additionally, some of the automated workflows in Intune, particularly the zero-hour purge, do not always trigger promptly.

I have been using Microsoft Defender XDR for two years now.

Microsoft Defender XDR has maintained high stability despite various service alerts. These alerts are targeted and informative, clearly indicating any potential functionality issues. The service has remained consistently online, with any issues isolated to specific components, suggesting a well-designed and modular architecture.

Our company has not experienced any scalability issues. As a medium-sized XDR company, scaling has not presented any challenges.

The technical support from Microsoft Defender XDR has been disappointingly slow, to the point that I am considering not renewing my unified support contract. However, I have not yet made a final decision.

Negative

We previously used Mimecast for email and Cylance for endpoints. We did not have any solutions for cloud apps. We switched to Microsoft Defender XDR because we already had the licensing for it, and it did not make sense to pay twice for a similar product.

The initial setup of Microsoft Defender XDR was straightforward, and we have not encountered any deployment issues. It was easy to manage with the bundled features.

We did not use an integrator, reseller, or consultant for the deployment of Microsoft Defender XDR. Most of the deployment was done in-house.

Ever since we turned on the M5 feature set back in June, we have seen a reduced number of potentially malicious clicks and faster alerting when incidents occur. It has improved our security posture.

The bundling of software makes it easier to manage our setup, but Microsoft purposefully obfuscates this through marketing ploys to hide costs. Although this can be challenging, ultimately, it simplifies budgeting.

We evaluated several options before switching to Microsoft Defender XDR, but ultimately chose it due to cost-effectiveness, as its features were already included in our existing license, though previously unused.

I would rate Microsoft Defender XDR an eight out of ten. I believe it is underrated by many, and some companies miss out by not knowing how to configure it properly. Microsoft's pricing makes setups difficult to manage, but the overall value is significant.

Public Cloud

Microsoft Azure

At FileVine, we provide case management software for attorneys, so we have considerable SOC 2 compliance requirements. We need more than a firewall; we also need a solution that helps us upkeep and manage devices, laptops, etc. 365 Defender fulfills these requirements, and SOC 2 compliance is our primary use case.

We're a hybrid company using both Macs and Dells, deployed across multiple regions.

The solution helps us improve compliance regarding end users installing updates. It clarifies which users need to update and how they can go into Terminal or PowerShell to perform that process. We don't have to waste time looking for what needs to be done, which is a useful functionality. The product automatically informs us of high and low priorities, which is great; it allows us to deal with the most significant priorities first.

365 Defender helps us automate routine tasks, and we get updated daily. We can integrate Splunk to see what's going on and what needs to be updated. Automation significantly impacts our security operations; it feels like we have a vault around us that nobody can breach.  

The Endpoint Manager is incredible; it has a very straightforward interface and is exceedingly easy to use. Pulling out and deploying different tags or resources is a simple task across various departments with different levels of security. The notifications are also simple and satisfying; it's great to see the bubble informing us which devices are compliant and which are waiting to update.

The visibility into threats provided by the solution is excellent. When a threat triggers a response based on our set rules, it's stopped, and we are notified via email. We can then analyze the threat and make a decision; this entire process is straightforward and user-friendly. 

The product helps us prioritize threats across the enterprise, especially in the legal domain. It is very valuable, and one of the reasons we have been so successful at Filevine is the security measures we have in place. We use many tools, one of them being Microsoft 365 Defender, which significantly contributes to our IT team and company's success.   

Our integration of multiple solutions helps to deliver a coordinated detection and response in our environment. We integrate with Zscalar, which is very easy and manageable. We thought it might be difficult, but it works very well. Much like a car, our security system is composed of many moving parts working together, which helps us move forwards as a company and thrive in a relatively challenging economic time. 

The comprehensiveness of the threat protection provided by using multiple Microsoft security products is excellent. It's a simple system; we have incoming and outgoing traffic rules. When a rule is triggered, we are notified by email to look over the situation. For example, we can see viruses and malicious actors attempting to breach our security and respond by blacklisting the IP address. Sometimes, we gather information and pass it on to the FBI, as we have many SOC 2 clients.

365 Defender helped eliminate multiple dashboards, which is great because I like to be as minimalistic as possible regarding dashboards. Now, I only have to look at one or two at most, simplifying the security landscape, and I love that about the tool.  

The solution's threat intelligence helps us prepare for potential threats before they hit; most recently, we were protected from the August 2022 Apple hack. We had measures in place, so none of our devices were affected. We were spared any data compromise, and it's an excellent example of why we invest in security solutions. It builds our confidence and strengthens our case with the higher-ups for increasing and maintaining our cybersecurity budget. 

The product certainly saves us time. We trust in the protection and can focus on different projects, including automation, so we don't have to spend time dealing with issues and security breaches. I'd say we save four or five hours a week.  

365 Defender saves us a lot of money because we don't have to recover data or hire outside lawyers to help us with legal trouble. We don't need to invest in physical products or external security teams and solutions. We can keep our security operation within the company, so all our money is invested in people who care about our product and business.  

The solution quickly notifies us when a threat is detected, increasing our response speed. Other products I used in the past sometimes had significant delays with notifications, which is far from ideal when dealing with potential security threats. 

Correctly updated records are the most significant area for improvement. There have been times when we were notified of a required fix; we would carry out the fix and confirm it but still get the same notification a week later. This seems to be a delay in records being updated and leads to false reporting, which is something that needs to be fixed.

I have been using the solution for a few years. 

The solution is very stable with low latency. 

The product is highly scalable, which is fantastic because we have been expanding significantly. It's up and running and good to go very quickly, which has been excellent for our expansion in Florida, New York, Maine, and Canada.

I have yet to contact support. One thing that helps in this regard is that I have an AZ-900 handbook with Microsoft fundamentals. 

365 Defender was already in place when I was brought into the company, but they previously used Jamf Protect. They switched because it cost too much and wasn't fulfilling the requirements. It didn't perform as well as 365.

I can't speak to the setup as the solution was in place when I arrived at the company. However, 365 Defender is one of the most lightweight tools we use in terms of maintenance. We keep it up to date, and it works very well.

I would say the solution gives us a significant ROI, especially considering the issues in the industry recently. Russia and China hacked many companies, but we never had that problem, and that's a lot of money saved for us. That's not entirely because of 365 Defender, but also thanks to our excellent security team and the robust toolset at our disposal to protect our operation.

The solution is affordable, and we haven't been hit with any hidden costs. The subscription model is straightforward, and it's easy to understand how much additional features cost. If we need to cancel a license or feature, we do that well in advance to avoid being charged for it, but overall, the pricing and licensing are simple and easy.

I would rate the solution an eight out of ten. 

We use multiple Microsoft security products, including Defender for Endpoint, MFA as a standard on all work laptops and computers, and Endpoint Manager. We use additional tools to protect the Mac side of our operation. We use Microsoft Intune, some other MDMs, and some other assets from Defender for Cloud, and for cloud security, we use GCP, Azure, and AWS. 

Many of these products are integrated, and the integration was relatively straightforward. It was somewhat time-consuming as we previously used Jamf Protect for a long time, so switching our entire infrastructure over to the new products took some time.   

Microsoft Azure

We offer an MDR service and use Microsoft Defender XDR with Defender for Endpoint, Defender for Cloud Apps, and Defender for Cloud.

Having Microsoft Defender XDR integrated into our ecosystem has helped provide a single pane of glass for identifying, monitoring, and responding to issues across multiple customers.

From an attack chain perspective, Defender XDR handles phishing and spam emails easily, while Defender for Endpoint manages endpoints effectively. We've drastically improved our user experience. Even though we have Check Point in place, without adding complexity, XDR helps manage a significant baseline, enhancing user productivity by reducing signals significantly. The ability to report phishing is more accessible with the add-on features in Outlook.

It would be beneficial to reduce the number of clicks required to navigate between blades, as the current navigation and breadcrumb system can be a bit confusing. Some inconsistencies exist between blades, which could be improved for a more seamless user and UI experience.

We have used Defender XDR for just over a year now.

The services within our ecosystem have been reliable, meeting their SLAs. However, sometimes the experience feels congested, likely due to increased usage, which indicates high adoption levels.

Microsoft Defender XDR shows tremendous scalability, much more so than on-premises solutions. Microsoft has ensured these capabilities are available for its customers.

Support has gotten better, but there is room for improvement. It's critical to escalate SEV B issues immediately to a domestic engineer. Having a CSAM makes a significant difference.

Positive

I have always worked with Microsoft solutions for the past twenty-five years, expanding my knowledge to include third-party solutions as Microsoft evolves rapidly.

The deployment wasn't intuitive,  but it was simple for me. The documentation helps despite a few gaps when they roll out new features. You need to understand the technology before you implement it. Read up as much as you can before establishing a dev tenant, implementing, testing, and then piloting in production.

I wasn't part of the M&A transition, so I'm unaware if a Microsoft partner was involved. I've served as a consultant with various Microsoft Gold partners, and without those partners, adoption would have been more challenging.

From a support desk perspective, there has been a decrease in support requests and an increase in user productivity. Although I don't have exact statistics, user experience has improved significantly, which is crucial for the company's progress.

Licensing is somewhat confusing, particularly when presenting our pitch decks to stakeholders and leveraging key features in premium SKUs, but we managed with some assistance from Microsoft.

I rate Microsoft Defender XDR 10 out of 10.

Public Cloud

We use Microsoft 365 Defender to provide cybersecurity to our clients. Microsoft 365 Defender provides real-time alerts which I review and analyze for our clients.

We implemented Microsoft 365 Defender to mitigate the cybersecurity threats our clients were facing. 

Microsoft 365 Defender is a valuable tool for our daily security operations. It provides us with a clear picture of security threats through its alert system, which identifies the origin of the attacks and correlates them with the MITRE ATT&CK framework.

It is user-friendly, loaded with features, and priced cheaper than the competitors.

Microsoft 365 Defender thwarts advanced attacks from spreading within our client's networks by utilizing the MITRE ATT&CK framework to recognize and categorize threats, then automatically taking steps to neutralize them.

Microsoft 365 Defender earns a rating of eight out of ten for its effectiveness in stopping attacks, which has demonstrably improved our security operations.

While Microsoft 365 Defender effectively stops attacks and adapts to new threats, human intervention is necessary for entirely new attack patterns. This is because the system relies on machine learning to identify threats based on past data, and completely new attack patterns wouldn't be recognized yet.

Microsoft 365 Defender enabled us to discontinue the use of other security products and helped save our security team time.

The most valuable features are machine learning, AI, and auto-remediation of non-malicious alerts. The onboarding and offboarding of devices are also seamless and the Windows Autopilot is helpful for our users.

Troubleshooting in Microsoft 365 Defender can be inefficient. Onboarding new devices with communication issues, for instance, requires using Veeam for log investigation and contacting Microsoft support, making the process time-consuming.

The current number of indicators of compromise provided by Microsoft is 15,000, but increasing this number would be beneficial for improving detection capabilities.

I have been using Microsoft 365 Defender for one year.

I would rate the stability of Microsoft 365 Defender ten out of ten.

I would rate the scalability of Microsoft 365 Defender ten out of ten.

Microsoft 365 Defender's technical support team is responsive, offering timely solutions to help our clients resolve their security issues.

Positive

In the past, we relied on both McAfee for antivirus protection and Cybereason Endpoint Detection & Response for advanced threat hunting, but we have since streamlined our security posture by consolidating these functions under Microsoft 365 Defender.

Microsoft 365 Defender is more user-friendly and flexible than Cybereason Endpoint Detection & Response.

Deploying Microsoft 365 Defender is a manageable process for our team of three, who handle our roughly eight thousand servers on an ongoing basis.

Microsoft 365 Defender offers competitive pricing. While purchasing an Azure subscription includes it in a bundled model, the standalone subscription cost for cloud storage and Defender itself remains reasonable, making it an affordable option compared to other security services.

I would rate Microsoft 365 Defender nine out of ten.

It takes some time to see the benefits because it is a large tool with many features that keep changing.

Our clients are enterprise-level.

Maintenance is required.

I recommend Microsoft 365 Defender to others.

Public Cloud

Microsoft Azure

I'm managing the SIEM, but the SIEM is heavily integrated with 365 Defender and all the other components. Defender is a natural extension of Sentinel, and our entire SOC team leverages the solution. We utilize it daily for everything related to incident response from an advanced threat-hunting perspective.

We do some KQL-based threat hunting and have set up some custom detections built into the platform, so we can raise an alert about a threat when we see it. Right now, we're onboarding our server environment to push Defender for server agents to see what that looks like. 

Defender is used widely by our SOC for everyday investigations. Our attack surface reduction teams use it for vulnerability information. Other teams at the company use the telemetry data, but it's primarily our SOC using it for incident response. 

Defender XDR has simplified our security operations because we don't need to shift around various portals. If I respond to an initial access event involving phishing emails, I can go to the endpoint and the user's identity in one console instead of having four or five different tabs open for multiple products. 

Since adopting Defender XDR, we haven't consolidated anything because the corporate leadership purchased the E5 license with all of Microsoft's other security solutions. All of those are still in play, but some of Defender's features are creeping into other spaces where it could potentially replace some of their products. 

It allows things like indicator blocking. You can block file caches now. You can block URLs, domains, etc. We might have handled that somewhere else with DNS and stuff like that. We might be blocking domains or adding different intelligence to handle that from the endpoint perspective so the threats are stopped before they get to the network. There are certain functions that Defender might not necessarily take over, but it can augment the entire approach to that security design. It could replace those solutions, but I'm not one to have all my eggs in one basket. However, that's not my decision to make.

Having everything in a single pane of glass saves some time, but it's hard to quantify. It reduces the time needed to respond. It correlates the data in a certain way that probably decreases time spent on manual data aggregation by about 30 minutes per incident. We can aggregate the logs from third-party solutions in Sentinel, run KQL queries there, and look at them together to make some assumptions. That's a significant time saving, but I don't think we're tracking that. 

The way it gathers data is fundamentally different. It's all right here, and I don't need to do separate queries. I can look through the timeline and export the data to a CSV if I want to sift through the data. It likely reduces the time it takes to respond dramatically. One problem we have internally is that we can't deploy Defender for Endpoint on everything. I can't deploy it on a many legacy OS due to the compatibility. It's challenging to address those things when you get so used to having all of this telemetry. When working through that, the advantages of using the platform become clear. It incentivizes us to stop using some of those assets because we can't see anything on them the same way that it gets represented in the M365D. We don't have direct telemetry ingestion into the cloud portal where we can collect logs from all those assets.

The most valuable feature is probably the aggregation and correlation of the different telemetry points with Defender for Identity, Defender for Endpoint, and Defender for Cloud Apps. All of these various things are part of that portal. We've wanted that single pane of glass for years. 

We've become early adopters of almost all of the features that they offer through the portal, so we've become good at working through the leading-edge quality of the new features and deciding whether or not we want to implement something in production based on that. We have a close relationship with Microsoft's team, and they present us with opportunities to enable new features, but all of the training is done internally. We have a close-knit team structured between our level two, level three and engineering team. And so we'll come together and say, "Here's this new thing we can do with Defender for Identity. We can reset users' passwords on-prem through the portal." We'll discuss these things and whether to implement them, but it's just our team.  

Defender provides unified identity and access management. There's probably some more granularity that could happen within the existing access control model. You can apply default labels for security admin and this or that. It depends on how you design it. A lot of our security admins can do at-will actions. We want them to be able to do anything else requiring an elevated set of privileges that allow you to design roles or stuff related to assets or identities. 

You have an audit trail for who's doing what, which is great. I think they could make the roles more granular. That would be ideal. Integrated identity and access management capabilities are core to the solution because you don't want people to have too much access. You want to control it to a point. We need people to be able to do what they need to, but I don't want everyone to have domain privileges because they can log into a domain controller through the portal. 

These are the kinds of things the portal lets you do, like the interactive sessions with Defender for Endpoint. However, I would like to see a just-in-time access approach that allows me to do something, and once I'm done with the action, it shuts off that capability.

Defender feels restricted to Microsoft products, but if we augment its capabilities with Sentinel, you can pull all your third-party data sources and everything into the SIEM. That immediately adds a different value to the product. Having some level of normalization on the data helps, but the ability to take data from third-party sources and correlate it with Microsoft sources is beneficial.

The solution stops the lateral movement of advanced threats like ransomware if you set it up correctly and are willing to accept the possibility of false positives on automated isolation, app restriction, etc. It entirely depends on what your team can do with rule tuning and use case detection. 

Our team does customized detections entirely based on what's happening in our environment. We have direct tuning capabilities.  We don't have an automated isolation-based task applied to out-of-the-box rules. That would be scary. We do our best to ensure false positives don't happen. If they do, we can control the outcome and make sure it can tune out the false positives. 

Defender can stop attacks and evolving threats because it can correlate data and make assumptions based on it. If you feed it all of your data, it will do an incredible job. It's dependent on your environment, but I think it does an excellent job of detecting perceived threats. At the same time, you still need a human being to monitor and tune it. 

The advanced threat-hunting capabilities are phenomenal, and the security copilot enhances that, but some data elements could be better or have more context inside of the advanced tables themselves. The schemas feel a little limited to what they're building into the product. It's probably just a maturity thing. I imagine we'll see the features I want in the next year.

Once you've onboarded your servers to Defender, they're housed on Azure. When those things are brought into the 365 Defender portal, I can see clearly that some of those are Azure resources. There is a subscription and the resource group. That data doesn't exist in the tables. We don't want to run automated remediation against our domain controllers, but you can't exclude those using Azure resource tags. You can't tell it to exclude assets from this resource group. 

That data doesn't exist inside the tables you use to build your thresholds or custom protections. I could see where they could improve the data they present to you in the tables. I assume that it will come with time. There's so much happening. Every time I open the portal, there's a new feature. 

We have used Microsoft Defender XDR since earlier this year and prior to this the Microsoft 365 Defender solution. We were early adopters of the platform and changes to the different products being integrated.

I rate Microsoft support seven out of 10. Sometimes, the support teams are great. However, sometimes we know more about the tool in some cases than the people we're talking to. We use it so heavily that our internal team has a better understanding of the toolset than the average SME should. We use it every day, so we live in the portal. I can't comment negatively or positively on the support. It depends. Sometimes, you might get somebody who knows what's going on, but in other cases, we have to figure out the solution on our own. 

The worst thing I can think of is when we need to reclassify a domain that they've called incorrectly. In that situation, you send a request into the abyss. you never get a response, and it's like, okay. Do I have to keep checking back over and over again to see if this has been reclassified? 

Neutral

We've experimented with other providers at this point, like Carbon Black. I think Defender meets the enterprise-grade criteria for our needs, but there are some nuanced differences between the solutions. 

I think it's hard to compare due to the sheer volume of the E5 ecosystem in one location. No other tools have that. If you bundle all the Microsoft solutions, it doesn't make sense to compare them to third-party solutions. Defender stands out in terms of gathering data and the way it presents everything in the incident timeline. The only thing it could do better is the filtering capabilities when you're pulling back the data from the timeline. 

Data is expensive if we want to leverage the telemetry that exists within the 365 ecosystem and bring that into Sentinel. I can't pipe that data in without paying an ingestion cost. I know how much data exists in each one of the tables that are there, and it would cost a significant amount of money to bring that in. 

I rate Microsoft Defender XDR 10 out of 10. I don't know of anybody else that's even remotely close to doing what they're doing. It's reduced my work in terms of identifying things. I might be in a position where I'm engineering, but I'm still technically on the response team. I'm using the tool the same way, and it has gotten better and better every time they add something new.

I use Microsoft Sentinel for monitoring cybersecurity threats as it is a SIM tool from Microsoft. Additionally, Microsoft Defender XDR provides security across multiple layers, deploying Defender for Endpoint on devices like laptops and desktops, Defender for Identity for Active Directory monitoring, and Defender for Office 365 for email security.

I find Microsoft Sentinel easier to configure since there is no need to manage all underlying components. Microsoft Defender XDR is effective for containment when threats occur, allowing for isolation of the host or account disabling. Although automation capabilities are better with Microsoft Sentinel, Microsoft Defender XDR shows potential. Integration with other Microsoft products is seamless, making it easier to create a unified security posture.

For Microsoft Defender XDR, there is currently no ability to reset passwords for on-premises accounts, which is a key challenge. Incident management can be difficult if third-party ITSM tools are connected with XDR. Initial tech support is slow in understanding problems. Improved integration with third-party ITSM solutions and enhanced automation in XDR would be beneficial.

I have been working with Microsoft Defender XDR for more than five years.

The deployment of Microsoft Defender XDR was not difficult. It is straightforward, and activating it involves just a couple of clicks.

I find Microsoft Defender XDR to be stable now.

Microsoft Defender XDR is definitely scalable.

The initial level of tech support is slow and rated as six out of ten. However, once issues are escalated to the second or third layer, the support is much better.

Neutral

For POC purposes, I have worked with CrowdStrike and Trellix XDR. However, I used Microsoft Defender XDR due to pre-existing Microsoft products in our ecosystem, ensuring seamless integration.

The initial setup of Microsoft Defender XDR is easy. It involves enabling the system with a few clicks and then tuning it as needed. I wanted to leverage Microsoft products across all security areas for better compatibility.

I have seen an ROI in terms of efficiency. Previously, identifying and containing threats took a long time, but now, with Microsoft Defender XDR, it takes just a few minutes.

The pricing for Microsoft Sentinel operates on a pay-as-you-go model based on data ingestion. I recall that Defender XDR pricing is based on the number of endpoints.

I evaluated CrowdStrike and Trellix XDR during the POC stage.

Based on my experience, I rate Microsoft Defender XDR as nine out of ten. If you are utilizing Microsoft in-house products for different security postures, go with Microsoft Defender XDR as it is easier to manage and scalable. It is notably the most compatible option if your organization already uses Microsoft products.

Other