Preface

Microsoft Defender for Endpoint (MDE) is a market-leading cross-platform endpoint security solution that enables you to prevent, detect, investigate, and respond to threats. MDE helps strengthen the security posture of your organization in many ways.

Thanks for purchasing this book! A lot of thought went into making sure we can get you armed and ready for a successful MDE deployment – without having to read page upon page on learn.microsoft.com (which, to be fair, are awesome docs, but typically don’t frame the larger context and can be very daunting to use when getting started). To this end, we aim to guide you through the various aspects of the suite, providing you with the following:

• Essential and interesting background information, leading to a greater understanding of what does what
• An in-depth knowledge of its applicability, leading you to know what goes where
• Deployment and configuration guidance, informing you how you can deploy successfully
• Guidance on daily operations for both systems management and security operations angles

It will also include expert tips and tricks (or recommended practices) that help you avoid common pitfalls and tell you what not to do.

We hope this book provides you with a broad background and deep insights into the various features of MDE based on the authors’ combined experience in incident response, security operations, and the architecture and development of the product. With a good mix of theory and practical examples that grow gradually in complexity, it prepares you to tackle real-world challenges!