Tips and tricks from the experts
Here are some handy tips and tricks we’ve collected, with some help from the community:
- Use https://security.microsoft.com/preferences2 to go straight to the MDE settings in the portal.
- If you are using command-line utilities to troubleshoot, you can use the pipe character to output to the clipboard:
"c:\Program Files\Windows Defender\MpCmdRun.exe" -ValidateMapsConnection | clip
- https://gpsearch.azurewebsites.net/ is a great resource to look up Defender settings and their descriptions.
@NathanMcNulty
shared the following:- Learning KQL is one of the highest ROI things you can do:
// Find ingestion delay
| extend IngestTime = ingestion_time()
| project-reorder TimeGenerated,IngestTime
- The API is incredible, use it
- Live Response can download and execute applications if you wrap them with scripts ;)
- Learning KQL is one of the highest ROI things you can do:
@rakidbrahman
shared the following: Device tags from...