Microsoft Defender for Endpoint
Endpoint detection and response (EDR) — Microsoft
What is this product?
An EDR that records device activity in queryable KQL tables such as `DeviceProcessEvents`, and lets you isolate a device or add a blocking indicator.
About the company
Part of the Microsoft Defender suite and built into modern Windows, which makes it the default choice for many Microsoft 365 organisations.
What does an analyst do inside it?
- Searches `DeviceProcessEvents` in KQL for the suspicious process.
- Reviews `InitiatingProcessFileName` to identify the parent process.
- Isolates the device when needed.
- Classifies the incident as a real threat or a false positive.
Its search language
These examples are written in the syntax the product itself accepts.
- DeviceProcessEvents | where DeviceName == "FIN-WS-014"
- DeviceProcessEvents | where FileName == "powershell.exe"
The field names it uses
- DeviceName
- AccountName
- FileName
- InitiatingProcessFileName
- ProcessCommandLine
- SHA256
- LocalIP
- RemoteIP
- ActionType
- ActionResult
Practise it now
Pick this product inside the simulator and the field names, search language, severity wording and response actions all switch to match how it works.
Open the simulatorWhere does it show up in the job market?
Most common in Windows and Microsoft 365 environments, and shares KQL with Sentinel and Entra ID.
Tools in the same category
The content is educational and follows the product's style. ShiftZero is not affiliated with the vendor and does not run its software.