What this book covers

Here are the chapters that make up Mastering Microsoft 365 Defender. The author of each is denoted by either (RC) or (VH).

Chapter 1, Microsoft and Modern Cybersecurity Threats, explains the current threat landscape and what we must defend against, followed by how Microsoft 365 Defender fits into this with an executive summary of its vast capabilities. (RC)

Chapter 2, Microsoft 365 Defender: The Big Picture, acts as an executive-level description of what Microsoft 365 Defender is and its vast capability set. (RC)

Chapter 3, The Fundamentals of Microsoft Defender for Endpoint, sets the foundations for learning about Microsoft Defender for Endpoint, such as important architectural points. (RC)

Chapter 4, Onboarding Windows Clients and Servers, guides you through the many different ways that both legacy and modern Windows operating systems can be onboarded into Microsoft Defender for Endpoint. (RC)

Chapter 5, Getting Started with Microsoft Defender Antivirus for Windows, covers basic management and interfaces for Windows, including topics such as the GUI and PowerShell, scanning exclusions, and updates. (RC)

Chapter 6, Advanced Microsoft Defender Antivirus for Windows, continues the learning path for protection on Windows, exploring cloud-delivered protection, potentially unwanted app protection, running modes, tamper protection, troubleshooting, and reporting. (RC)

Chapter 7, Managing Attack Surface Reduction for Windows, focuses on a huge set of proactive security capabilities collectively called attack surface reduction (ASR): ASR rules, controlled folder access, exploit protection, and network layer protection. (RC)

Chapter 8, Managing Additional Capabilities for Windows, finishes the Windows capabilities path by covering device discovery, device control, and firewall management. (RC)

Chapter 9, Onboarding and Managing macOS, teaches you how to onboard and then manage your macOS estate with Microsoft Defender for Endpoint. (RC)

Chapter 10, Onboarding and Managing Linux Servers, picks up from the previous chapter by continuing to cover Linux server onboarding and management. (RC)

Chapter 11, Onboarding and Managing iOS and Android, wraps up the journey of Microsoft Defender for Endpoint’s huge OS scope, as you’ll learn how to get your mobile devices protected. (RC)

Chapter 12, Deploying Microsoft Defender for Identity, covers what Microsoft Defender for Identity is and what it can be used for. It also goes into detail on how to deploy this solution in your environment to monitor your on-premises Active Directory. (VH)

Chapter 13, Managing Defender for Identity, builds on the knowledge gathered in Chapter 12 and focuses on how to manage this solution, both in terms of managing security alerts and health alerts. (VH)

Chapter 14, Deploying Exchange Online Protection, teaches you how to deploy the first line of email and collaboration defense in Exchange Online Protection. (VH)

Chapter 15, Deploying Defender for Office 365, covers the second part of the email and collaboration defenses in Microsoft 365, and how to deploy it. It will go into detail on how to configure the solution-specific details in Defender for Office 365 as well as look at how it integrates with Exchange Online Protection to offer security through the entire email chain. (VH)

Chapter 16, Implementing and Managing Microsoft Defender for Cloud Apps, covers the cloud access security broker and SaaS security tool in the Microsoft 365 Defender platform, by teaching you about its capabilities, how to deploy them, and how to integrate with other services such as Azure AD and your other SaaS apps. (RC)

Chapter 17, Maintaining Security Hygiene and Threat Awareness, teaches you all about proactive security measures by covering Microsoft Defender Vulnerability Management and threat analytics so that you can block threats before you even need to respond. (RC)

Chapter 18, Extended Detection and Response with Microsoft 365 Defender, looks at how Microsoft 365 Defender is used in an XDR sense, and how you can utilize these solutions together to identify, triage, and respond to incidents. (VH)

Chapter 19, Advanced Hunting with KQL, covers how to use KQL to perform advanced searches in your Microsoft 365 Defender solutions. It also gives you detailed knowledge about how to create custom detections, which is a vital part of using Microsoft 365 Defender. (VH)

Chapter 20, Microsoft Sentinel Integration, shows you how to integrate Microsoft 365 Defender with Microsoft Sentinel so that, if you use Sentinel, you can centrally respond to incidents. (RC)

Chapter 21, Understanding Microsoft 365 Defender APIs, explores the different APIs available for working with Microsoft 365 Defender, including recommendations about when to use each. (RC)

Chapter 22, Glossary, provides a quick lookup reference of common terms and abbreviations used in Microsoft 365 Defender.

Chapter 23, Answers, gives you the answers to the questions posed at the end of each chapter.