Intro To Microsoft Defender XDR

0:00All right we're in the first skill of the new SE200 course here at CBT Nuggets and guess what it's time to talk about some things that you'll need to have in place if you want to follow along with me and get some hands-on experience. So we're going to look at these three things and how to get those up and running. So let's get started. All right so three things you're going to need. Number one is a Microsoft 365 E5 or A5 trial account. Unless you have one. You might have an active E5 or A5 subscription and that will work. But here's the thing you're not looking for an Office 365 E5 or A5. That's not what we want. We want a Microsoft 365 E5 or A5 subscription.

0:49So we're going to see how to set up a trial for that. It is a 30-day trial. So after that 30 days you might need to create a new trial and we're going to talk about that here shortly. The other thing is you're going to want an Azure trial as well. Absolutely and as of the recording of this nugget when you sign up for a trial you get $200 of credit. Hey that's pretty awesome. Now that way if you're going to use some of the resources that we're using you can use that credit toward that so you don't have to pay out of pocket. And lastly what you're going to need is a Windows 11 workstation. So we need an endpoint or basically a device running Windows 11 that you have administrative permissions on. Now why do we need this device? We need it because we're going to install Defender for endpoint on it so that we can have it send logs and information into our Defender XDR so that we can work with that. So if you already have yourself a Windows 11 workstation you're good to go. But you do have to have administrative privileges over it so you can install Defender for endpoint. And you're going to be registering that in Microsoft

2:04through the intra ID with your trial account that we create up here your Microsoft 365 E5 or A5. Now we do the trial it's going to be E5 but you can have maybe you have an A5 account. Hey that works too. But you do have to have that level of access and we're going to go over licensing and such a little later on. So now that we know we need these three things I'm going to tell you that this last piece is going to be up to you and whatever you want to do for this. Now that means you could build if you have a home lab maybe you're running some hypervisor or something like VMware or or Microsoft Hyper-V then you can run this as a VM in your lab. Hey that's cool it works. But if you want to spin up a Windows 11 machine and run it in Azure and use some of those credits you can do that as well. But however you go about that that's pretty much going to be up to you at this point. And it doesn't have to be in Azure it can be on your lab again at the house. It just needs internet access so that we can install our Defender for Endpoint and Defender for Endpoint can talk to Defender in the cloud. Okay so I'm going to walk through here now how to go through setting up your Microsoft 365 E5 trial and your

3:20Azure trial and setting up some fail safe to make sure that we don't go over budget or forget to cancel our trial because nobody wants to do that. All right cool so let's get started on these necessities. All right here we are we're going to talk about creating our Office 365 E5 account and I'm going to provide a link to this page but you can see it up here it's microsoft.com slash en dash us slash Microsoft dash 365 slash enterprise slash office dash 365 dash E5. Wow it's a mouthful that's why I'm going to provide a link below or you can just google it but you do need to find this page so you can create a trial here. A lot of the pages that you go to when you google it are going to take you to where you have to call sales and stuff and we don't want to do that. We're looking at right here try for free that's what we want to see right there.

4:11Once we see that we know we're in the right place. Now I know I said you need to get a Microsoft 365 E5 trial not an office trial but this is a hoop that we have to jump through because you can't just outright get a trial of Microsoft 365 E5. They want you to contact sales so this is a hoop and we're going to jump through it. So what we'll do is once you get here and you'll see it is $38 per user per month when you pay it yearly but if you select monthly it's going to be more than that it's just because you get that annual discount but we're not worried about that we're going to try it for free. So if you click try it for free here it's going to open up this new page and this is where you're going to go through the signup. So how many people is this for because you can select multiple trials if you want to set up multiple Windows 11 devices and have different fake users connect in then you can do that but here's where I want to point out choose the length of your subscription I'm going to say one month and here's why. Now you'll see yeah by the year it's $39.90 a month if you go monthly it's $45.60 but here's the thing we're going to try this trial and this trial is good for 30 days okay so that means if you don't cancel it before those 30 days

5:28are up you're going to get billed and if you accidentally have that happen I'd rather be billed $45.60 for that month than paying an entire year's worth because you're going to pay that one year up front okay so then you're stuck with it for a year and you've lost that however much it is it's well what how much is it it's about 40 so you're locking up close to $500 so yeah I'd rather lose $45 than $500 or somewhere around there because I forgot to cancel a subscription so then you're just going to go next and you're going to go through this process of setting up your account then you're going to have one now here's the thing so once you've finished setting this up what you're going to do is you're going to log in to office.com let me go find mine here you go and you're going to select the admin so if I let me show you here real quick so if you go to office.com and you sign in there it is it's going to look something like this you want to go down to apps and then you're going to go to admin it's going to open up your admin page there we go okay so at this point we're in our Microsoft 365 admin center here and we have an office 365 e5 account but not a Microsoft 365 e5 and they are really different okay so what we need to do is come down here to billing you're going to go down to your products here and then what you're going

6:48to see in here is a little bit different than what mine shows mine shows Microsoft 365 e5 yours are going to show office 365 e5 and that's fine it's supposed to at this point now here's what we do we're going to go to add more products right here you see that button we're going to click on that it's going to take you to the marketplace this is where you want to be come down here to the search let's see it's down here come on it I got to wait on it to reload oh actually I don't want recommended make sure you go to all products all right and then come down here to the search we'll get remove that there you go in the search you're going to type capital e number five e5 hit enter and let it search through it might take a little bit and there you go it's going to load this up look at there right here I'm going to zoom in for you Microsoft 365 e5 that's what we want that's the golden nugget okay so what are we going to do how do we get it Bob well the good thing is we get a trial so just click on details it's going to load this up and there it goes so from here you can choose right here Microsoft let me try to zoom in a little bit uh 365 e5 trial and it's going to bring this window out here and there it goes and you're going to have to make

8:04sure your appropriate credit card is in there get this but what it does is quantity 25 let me zoom in so this is a trial and it gives you 25 licenses to start with okay so what I'm going to do is hit next so I'm going to close this out so then you're just going to come down here and press that start free trial button so go ahead and click on that it's going to take a moment and there it goes you select your billing account information there and it says to keep these services active renew your subscription before your trial expires on March 9th 2026 it'll give you a month out there but then you're going to need to create another reminder in your phone to go ahead and cancel this so you have 30 days so this is the kind of hoops we have to jump through to get a Microsoft 365 e5 account I'm going to cancel this because I'm not actually going to get that and then once you do have it you're going to come back here to your products and we'll let this load up here and you'll find your Microsoft 365 e5 and you'll click on that because we have to assign this license to someone and well we're going to sign it to our own account and then

9:22in here you're going to click assign licenses there you go it's going to take you to your licenses and subscriptions but you can go down here to get that too all right and then you're going to select assign license because you'll have one of one up there or actually if you get 25 trials you'll have 25 up there that you can play with but they do all expire at the same time they're only good for a month not you can't use one one month and one the next and one the next they all expire within a month so then you're going to assign your licenses and you be sure to sign it to your account and then any of your other trial accounts you might set up because actually what you can do is come in here and you can set up additional users and assign it to them as well and these would be like fake accounts that you're going to use to play around in here with so that is very important because once you get that Microsoft 365 e5 trials you have to assign them to yourself okay so that you'll have that to be able to work with okay so that wraps this part up next you're going to want to let me find my tab here go to azure.microsoft.com and it's going to take you to this page here because now it's time to set up our azure account so what we're going to do is click on get started with azure just like that button right there and try azure for free so when you click on this it'll bring this up and you're going to have to sign in with the account that you just made for your Microsoft 365 e5 now i can't actually go through that process but you're

10:43going to do that and you're going to walk through setting it up and you will get it should say down here yeah right here $200 credit you see that and that's what we're wanting so that we can use now you got to use it within 30 days so again you're going to when you sign up for these let me give you this little tip here when you're signing up for these create a kind of i'd say throwaway free gmail account or some other email provider that's free because once you sign up for a trial and that 30 days ends you can't re-sign up with that email account so you don't want to use your primary email account like your personal one don't do that create a separate one just for the trial and that way when your trial expires and you cancel your services you can go sign up from again with a different email hopefully that will work for you but again sometimes it does match it to a credit card so you might run into some issues there because i know for a fact that when you're doing your azure setup and you're actually microsoft 365 you're going to have to provide a credit card in order to get that going but this is why we want to set up reminders to cancel ahead of time okay so you're going to go through and you're going to set up your azure free account just go through the wizard and set it up and once you do that you are signed up and let me show you

12:01next what we're going to do and this is we're going to set up a budget and a budget alert let me explain why let me go over to here to cost analysis let's go to this is in microsoft azure so once you're signed in just search for budgets just like this you see the budgets and you click on budgets so you're going to come in here to the budgets and since i don't have any budgets so what i'm going to do is go to add all right you're going to create a budget and what this is is you're basically saying this is what i'm allowed to spend for this month okay and then you can set up rules saying hey send me an email notification to when i'm getting close to matching my budget and here what we're going to do is set one up for two hundred dollars so here we'll call this azure trial dash 200 because that's your 200 credits reset period is monthly creation date was just january all right that works for me budget amount is going to be that 200 there we go and we'll say next and now here this is what we want alerts alert condition select type i want a an actual cost so this is what i'm actually spending okay and then the percent of the budget i would say like 80 and then action group we'll set to leave it none at this

13:23point because we don't have one but then you're going to come down here to your email recipients you're going to put in as many emails as you want but you're going to want to make sure it's email accounts that you're going to look at those emails you're going to see these notifications because this way once your budget and your 30-day trial hits 160 you're going to be notified because then you can go in and turn services off before you go over 200 this gives you plenty of time to do that because if it goes over 200 your credit card is going to be charged and we're trying to avoid that so put your email addresses in here so it'd be email at email emails whatever dot com and you just comma separated so then you're going to have dot com or something like that and you can put another one in here you can say email to at email.com and you can put a third one in there but the idea is you're going to put those emails in there so that you can be alerted you don't want to go over that 200 all right so this is your alert conditions so then you would go ahead and click on create and away you go and actually the default language you could go ahead and hit wherever you are your language and then go ahead and create that so that you will have a budget all right so at that point you would be good to go with your budget created okay so let's go to the next thing now we've got one more thing that we want to do in here and that is to disable

14:44what's known as the security defaults because they're going to cause us some issues in the lab so what you're going to do is you're going to go over to intra id so let's go ahead and go back to home so say okay there we go and there's microsoft intra id but you can always just type intra id in there and you want to go over to microsoft intra id this is basically our identity provider within entry used to be azure active directory now it's intra id here's our users and groups we've got devices and roles and administrative units and all kinds of wonderful things in here but here at the overview what we want to do is go over to the properties tab right here and we're going to click on properties it's going to fill this out for us and then what we're going to do is scroll to the bottom and right here security defaults you see that there it says security defaults are basic identity security mechanisms recommended by microsoft but we want to disable it so you're going to click on manage security defaults and you're going to say disabled and then it'll prompt you well why do you want to do this and you can just pick any of the reasons it doesn't matter but the most accurate reason is conditional access policy something to deal with that because we're going to be dealing with conditional access policies all right which is a great microsoft security feature they're great i love them they do lots of good stuff for security wise but you

16:02want to make sure that is disabled all right and then we're going to be working with that a little later on all right so at this point you just need to get your windows 11 device set up and available with internet connection and then we'll be able to get started so in the next nugget now that we've got these things out of the way we're going to start talking about what microsoft defender xdr is and why it's pretty darn cool actually i really like it a lot so i'll see you there shortly

0:01So, the question of the day, what is Microsoft Defender XDR? Come on Bob, spill the beans already. Well, that's what we're going to do in this nugget. That's right, we're going to talk about XDR and exactly what it is. Let's get started. Alright, so, what is it? That's the big question. Well, let's start off with what XDR stands for. It stands for Extended Detection and Response. Alright, let's talk about these. So, it's extended because it can see into all the Defender products.

0:31All those Defender products are sending their logs and information into Defender XDR for lots of things like detection and response. So, that's why it's known as extended. It's getting to see into the Microsoft ecosystem. We're talking about things like email, or your office products, identities, and cloud apps, and endpoints, and more.

1:01Yes, that's right, there's more. So, then on to detection. So, XDR receives a large amount of security data from these endpoints and from these systems. And it also accesses and analyzes end-user behavioral data from these products. So, that's pretty important. And it analyzes and correlates. So, that's the key here. Analyze and correlate. Now, what does correlate really mean?

1:31Well, it's the idea that if I'm able to see into all these different products across my network, and my systems, and my environment, I'm going to have a lot of insight as to what exactly is going on. Because I can see that something happened over here and it's related to what's over here. And if I analyze it, I can find that it's also over here and something out on the World Wide Web or something. So, it's able to analyze all this information and do correlation to figure out exactly what's going on.

2:03It's just like, if you think about it, your day-to-day life, the way for you to make good decisions is to be informed about what's going on around you. And at work, maybe it's helpful that you understand what different departments are doing or groups within your department, so that you can make better decisions and see the big picture. That's what happens here is our Defender XDR gets to see the big picture of everything that's going on. So that it can do the analysis and correlation to figure out when an event has occurred.

2:35At which point, we have response. So, Defender XDR has the ability to automatically respond to an incident in near real-time and disrupt the attack. So, near real-time responses. And it's really looking to disrupt the attack. Stop it in its tracks before it has time to complete and take hold. And along with this response, it provides a lot of information along with it.

3:06For example, if there is an attack, it's going to give you information like IPs involved, domain names involved, devices involved, identities that are involved in it. All kinds of information that it's doing with the correlation. So, it can show you everything that was involved in this, so that you can do follow-ups to it and understand. Now, the other thing that's pretty cool is AI. Yes, AI is built into it.

3:36So, that we can use plain speak to create advanced queries and help with investigations and such. So, we can do that. And we're going to get into that a little later on more. So, this is what it is in a nutshell. Here we go. Nutshell. We've got Microsoft XDR here in the center. Defender for Identity, Defender for Endpoint, IoT, Defender for Cloud, Cloud Apps, Office, and more. Yes, this isn't everything. It's just to give you the idea that all the Defender products are feeding information into XDR.

4:09And XDR is able to then do the analysis, correlation, and response and create incidents that we can then investigate. For example, we say automated response. Well, that's generally for more of the simple attacks that occur. When it comes to a more complex attack, when we're talking about various levels of the attack, so it's very complicated, at that point, alerts will happen and an incident ticket is going to be created within XDR or Defender so that you can investigate.

4:48So, just be aware of that. And we're going to go through all that again. Don't worry. So, now that we see this, we can think of XDR as a single pane of glass into our Defender products in the Microsoft ecosystem. So, here's a full list of the products, and we see there's quite a bit in here. So, your Defender for Endpoint. I better change colors here. Our Defender for Office 365, Defender for Identity, Cloud Apps, Defender for Vulnerability Management, Defender for Cloud, ID Protection, Data Loss Prevention, App Governance, and Microsoft Purview, as far as Insider Risk Management.

5:30So, all of this stuff feeds into XDR. That is a whole lot of information, as you can imagine. Now, again, one of the great features is the ability of automated response. So, this lady is pretty happy about automated responses because we don't have to wait for a SOC analyst to perform the investigation. So, you got your analyst over here thinking, hmm, and then performing an investigation, which takes time. And then they say, oh, we need to change this.

6:02Okay, whatever this is. It has to be changed. So, we need to create a firewall rule, whatever it might be. Well, the thing is, that person's most likely not going to be doing that. That's going to be another team within the organization. So, then that has to go to the other team. Well, the thing is, then it has to be assigned to someone to do. There might be change management practices that have to occur. You see where I'm going. When an automated response happens, again, it is in near real time. Whereas, if we had something like down here, it might take an hour for that to happen.

6:36It might take six hours for that to happen. Who knows? So, you see the difference here. Pretty darn important. All right, next up, threat intelligence. So, Microsoft Defender XDR does use threat intelligence. Now, the question is, what is threat intelligence? Here we go. Threat Intel. Now, this comes from the Microsoft Threat Intel teams. They have their own Intel teams that are working on this. And that information that they derive and come up with is fed down to Defender XDR.

7:07And some of that information is things like known malicious IP addresses, known malicious domain names, known attack methods, malicious file hatches. And the list goes on and on and on. This is information. This is Intel that is about risky events. Okay? And those events are where we match up with these specific data points. So, we have known bad actors using various domains, IP addresses, methods, file hatches, all this stuff.

7:39And so, these can be clues to kind of signal to us, hey, there's something going on here. This known malicious activity has been seen elsewhere in a breach. Now, we see it here. So, we should look at this. And that's fed down into our Defender XDR. Now, I do want to say, I want to start this early. I'm not going to be referring to Defender XDR by that name every time. It's most likely just going to be Defender. Because you'll see, once we're in there and working in the Defender portal, it's just Defender.

8:09It doesn't say Defender XDR. Because XDR is just what it is. It provides you your extended detection and response. That's kind of what it does. Defender is still really the name for it. So, we're going to see Defender throughout this course, of course. So, I just wanted to give you a heads up. So, I'm not forgetting it. It's just for simplicity's sake. So, what does XDR do? XDR at work. Well, the first thing it does is, as that security data flows into the Defender, the data is normalized.

8:43This is normal data. I can read it. What's so normal about it? Well, here's the thing. When you have data coming in from various applications and services, it's not always the same format. So, your fields are going to be a little bit different. They might be the same name. We'll say, like, timestamp. And you might have device. And it might be a user, UPN, or whatever it is. They're in different formats. They're in different fields or in different places.

9:13And in order to make it all come together and appear like it is one set of data, that's what normalization is. So, as that data comes in, it is formatted so that it looks like it is all in the same format. That's the normalization data. It just makes when we're dealing with it and analyzing it so much easier. If you've ever had to do an investigation, even something small, and you have to go look at the system logs, when it consists of more than one system that you're looking at, you have your timestamps in here.

9:44You've got all this log information. And over here, you have another system. And you have to correlate between those and look at the logs to see, well, what happened here at this time and over here at this. You don't have to do any of that or even worry about it. It's fed in. It's normalized. So, it's very easy to sort through and analyze. That's the whole idea behind normalizing the data. Okay, after the data is normalized, well, we've got analysis. Absolutely. We talked about analysis and correlation. So, that is that Defender looking at that data to identify abnormal activity or suspicious data points, such as known malicious IP addresses, domain names, all those things, but also that abnormal activity.

10:26Because, generally, these systems will manage by exception, meaning they know what's normal. After a little while, they learn what's normal. So, when something is abnormal, that raises the flag. And then we're like, hmm, we should probably look into that. And then, lastly, Defender, once it goes through and does the analysis and correlation, it will create incidents and alerts. And it can, again, of course, do the auto response if we configure it to do so for various incidents or scenarios.

10:59But then you're also going to have those incidents, which are basically like incident tickets that are created, so that you can add notes, you do research, and you do that kind of stuff in it. And, of course, sending alerts. That's pretty important, too. And when it creates these tickets and alerts, it's providing lots of telemetry data. So, let me put over telemetry data. And we're going to talk about what that is. We actually already have briefly, but it's the idea that in this incident ticket, you're going to have information about the devices, the IPs, users, services, cloud, apps or workloads, mailboxes, all kinds of stuff.

11:40So, this is telemetry data. And, again, back when we're talking about analyzing and correlation, that correlation where Defender was finding all these little things that were tied together, well, this is all the information and much more that's going to be fed down into that telemetry data. Really give you the ability to see the big picture within that incident.

0:00All right, moving on. Great tools for SOCs. Your Security Operations Center, or SOC, is a great place for Defender. Absolutely, because if you've ever worked as a security analyst or even attempted to investigate an incident, you know that digging through all those logs on those various systems, like I mentioned, is such a pain in the rear and it takes forever and just so slow and in these days and times inadequate. Not good, right? Absolutely not. So when we introduce Defender into this, and let's say we're a Microsoft shop, hey, this makes a lot of sense. We have maybe some Azure workloads. We're using intra-ID as our identity provider. We're using the Office stack. Now, we could be doing all this.

0:50And when you're running a highly Microsoft centralized shop, man, I'll tell you what, Defender can really, really get you some great information and provide adequate defense, okay? And even their Defender for Endpoint, I remember several years ago, this is several years ago, thinking, wow, this is horrible. Well, I'll tell you what, folks, in the last few years, Defender for Endpoint has become an amazing endpoint protection platform, all right? And now I'm just not blowing smoke here. It is very good. So that's why I'm excited to see how Microsoft has taken this route. They make all these little pieces and services that are security-centered around individual services like identity, Office, cloud workloads and such, but then it feeds that data back into our Defender so that we can do the analysis and correlation instances. I mean, honestly, it's just really great seeing this done this way.

1:52I'm pretty excited about it. I love it because I did the last SE200 course. And at that point, and that was like three years ago, about, and maybe three and a half, I could see that this was on the horizon. They were going this direction, but wasn't sure if they'd ever really fully get there. But guess what, folks, they have. It's here. And that's why this is a whole new course because of the changes they made. And it's pretty awesome. Now, guess what else comes with our Defender XDR? That's right. Absolutely. Microsoft Copilot, because I had mentioned earlier, AUI was available. Well, that's because we've got our Copilot right here, integrated into Defender. So that means when you're in a hurry and you're having a hard time thinking about exact queries that you want to run for a KQL query, guess what you can do? You can just speak it. Tell Copilot, I want to look for this IP address in this timeframe, looking for these applications or services or such. And guess what? It can write those queries for you. It can help you do your investigations. So if you're not great at KQL queries, or you're just under stress and you need to get things quick and you're not thinking completely straight and trying to remember all those formats and keywords and such, Copilot is there to assist. Yes, absolutely. All right. Now, one more thing I want to talk about, and that is SIEMs versus Defender

3:11XDR. Now, if you're not familiar with a SIEM, that is a security information and event management platform. Now, a SIEM, let's talk about what this is if you're not familiar with the SIEM. Now, if you are, bear with me or just speed up a little bit. Get to where we talk about Defender XDR and how they're different. Now, a SIEM is meant to ingest large amounts of data. Now, Defender XDR can ingest large amounts as well. But when we talk about large, we're talking about terabytes. That's what I mean by large, not 100 gig, but terabytes a day. So SIEMs can do that.

3:52They're built for that. And really what they are is you can configure just about anything to send data to a SIEM. So the SIEM is to collect all of this security information from all these different products, different vendors, different types of products. So it could be logs from a switch or a firewall. But it can also collect data from applications and identity providers, different identity providers, and anything you can think of just about that creates logs, you can send them to a SIEM. And the SIEM will then do analysis on that and will say, hey, this is something you should look at. However, what SIEMs do not do as a SIEM in general. Now, if you've got like a specialized SIEM, then it might do this. But in general, SIEMs do not provide automated response. So SIEMs are an analysis and correlation, and they will provide alerting when there's something out there that it found. That's what SIEMs do. So I think I just spoiled this for you. So here we go. Ingest large amounts of data used for log management, incident management and compliance. Yes. And I do want to say this is key here,

5:09the compliance part. When you're talking about compliance, oftentimes SIEMs are required as part of compliance because they're also used for log management where you can retain logs for 90 days if you need to. But for longer than that, generally, you need another solution. But of course, they're used for incident management because they get all these logs from all these systems. So you have them all in one place and you can analyze them there. And then lastly, they don't provide automated remediation. So, yeah, I just kind of put all that up there. Now, let's compare that to Defender XDR because Defender XDR, guess what? It only ingests data from pre-built connectors that Microsoft creates. So really, it's ingesting data from Microsoft services. OK, it's not going to allow you to ingest anything from anywhere like a SIEM will do just about. Also provides telemetry and activity data for analysis. We talked about that as well.

6:02So when it's doing that analysis and correlation, it's going to give you that telemetry and activity data, which is super awesome. But also, of course, we don't want to forget provides automated response which SIEMs do not do. Now, I do want to say we have something called SOAR, S-O-A-R, and that is security orchestration, automation and response. So what security orchestration means is that you can create like a playbook and orchestration of what you want to do and then automatically use it to respond to something. Yes, Defender XDR is a SOAR. Defender XDR is not a SIEM. No, it is not.

6:44So I want you to understand that. Now, we are going to talk about Microsoft Sentinel and work with that. And guess what? Sentinel is a SIEM and is also a SOAR. So it is a SOAR SIEM solution. But when you're talking about just a SIEM, I want you to understand Defender XDR is not a SIEM. It is providing analysis and correlation from your Defender and Microsoft security products and providing automated remediation. All right. So that is a big nutshell, I understand. But that's what Microsoft Defender XDR is. Next up, we're going to talk about some Microsoft Defender prerequisites. So I'll see you there shortly.

0:00Now that we know what Microsoft Defender XDR is, it's time for us to talk about the prerequisites, because you're going to need to know what those are in order to make sure you have the right licensing and permissions to go ahead and use it, right? Absolutely. So let's get started. All right, here we go. Microsoft Defender XDR prerequisites. I will include links to a couple of sites here underneath the nugget. So we're going to focus on here's the licensing requirements here. So if I scroll on down here, we can get a little briefing of XDR. We already know what that is, but here's the licensing requirements. So as I said earlier, Microsoft 365, not Office 365, this is completely different. Microsoft 365, E5 or A5, out of the gate, give you what you need. You get all the bells and whistles and the Defender products and Defender XDR. That's wonderful. Now, if you have 365 E3, you can add on Defender Suite, okay? And that'll get you there. Or you can add on the Enterprise Mobility and Security E5 add-on. Maybe you want to go that route. Now, if you're A3, you need to add in your Microsoft 365 A5 Security add-on.

1:12All right, and then there's some more down here. I'm not going to go through every one of these and bore you out of your mind. The primary thing is you need to remember you need a Microsoft 365, E5 or A5. If you have something other than that dealing with an E3, you're going to need an add-on of some sort, all right? Just keep that in mind. And if we scroll down here, they're going to talk about checking your existing licenses. And we already went through that. We went to our Microsoft Office Admin page, went to Billing and the License to see what we had, and also assign a license to our account, make sure we had it. We're going to talk about required permissions here. You can look at that. But we're going to go through and actually look at those permissions here in just actually a couple of skills here. We're going to go through and set up a group with all the necessary permissions so that we can use principle of least privilege and not just give everybody who needs access to Defender our global admin kind of access. No, we don't do that. All right, super. So those are the licensing requirements in order to gain access into Defender.

2:18All right, what else are we going to talk about? Over here. So when we're talking about, let me scroll down here, Microsoft 365 E3 versus E5. Okay, we're going to scroll down here and look at the difference. I want to scroll on down. I'm going to go way down here because I'm looking to go down to Security and Administration, and then also our Cyber Threat Protection. So let's go ahead and scroll on down. Oh, I went a little too far. Okay, there it is, Security and Administration. So we see E5 comes with Plan 2, and this is Microsoft Intra ID Plan 2. So what's the difference between Plan 1 and Plan 2? Well, Plan 2 adds some advanced security features like AI-driven identity protection. That's pretty cool. Also, risk-based conditional access policies. Now with Plan 1, you get some conditional access policies you can create, but they're just kind of like old school firewall rules, right? They did the job, but they could be so much better. And then we had like new types of firewalls come out and different types of rule sets. Well, this is like that.

3:22It's able to understand risky events that have occurred in your environment. And if like a certain identity had risky sign-ins, it could force that user to reset their password or to re-authenticate with MFA or could lock the account. And those are the type of things you get with Plan 2, those risk-based conditional access policies. It also gives you PIM or Privileged Identity Management, which is awesome, and some automated governance features. So really, the E5 and the Intra ID Plan 2 is really great for companies who need compliance. All right, I'll just leave it at that. All right, let's scroll on down to our Cyber Threat Protection. Here we go, right here, Cyber Threat. So what do we get down here? Well, you get your AI-powered Defender for Endpoint. You have Defender for Office 365, Defender for Identity. You have AI tools with Microsoft Defender for Cloud Apps Discovery and also Defender for Cloud Apps for your SaaS application, that's your Software as a Service apps. And for IoT, you've got Microsoft Defender for IoT. You get that as well. And then as it goes down, you've got Microsoft Purview Data Loss Protection or DLP. Wow, I mean, we get a lot.

4:34You got your Microsoft Purview Information Protection. Again, pretty good stuff. And then Microsoft Purview for Insider Risk Management as well. So you get a lot. And then when it comes to compliance, you have the ability to log and search for audited activities within Microsoft Purview. So within Purview, you can create an audit, you can create parameters around that, and it's going to go out and find certain information. And you're going to be able to, you know, do a self audit and find that information to prove that you're doing certain things as far as compliance. You also get Purview eDiscovery. Now, eDiscovery goes out and looks for certain types of data. If there was some type of a breach, you would do eDiscovery looking for information related to that breach, and it would go through your environment and find that information and bring it together for you, making it fairly easy to collect the necessary information for an investigation. And then lastly, Microsoft Purview Communication Compliance, dealing with business contact violations, where you can create rules along the lines of watching communications, looking for keywords, or it could be lots of different things. But again, you get all these bells and whistles with that Microsoft 365 E5, and of course, Defender XDR, which again, we're just going to go with Defender from here on out. But I'll say XDR because it's fun. All right, so those

5:53are prerequisites for using Microsoft Defender XDR.