Making sense of it
As the limitations of ETW were reached, and needed an agent that used less bandwidth and fewer machine resources, it became clear what the EDR product should be. Project Seville was started; Sense (which is the name of the EDR sensor) was born. The existing cooked data was used to continue development, and collaboration with the Microsoft blue teams intensified to define more scenarios. To overcome the limitations of ETW, Sense was built into the operating system (Windows 10), and kernel and memory sensors were added as part of operating system development, giving Microsoft Defender ATP deeper optics than ever before.
The following screenshot shows the cloud user interface that was built to replace the Excel workbook that was widely used by internal Microsoft defenders:
Figure 1.1 – Cloud interface that replaced the previously used Excel workbook
Closer to what people may know today, which is what we see in the following screenshot, was version 2:
Figure 1.2 – Second version of the Defender dashboard
Some elements in the current Microsoft 365 Defender portal still bear some resemblance, but the overall experience is vastly different.
