Does anyone else find themselves putting in MS Tickets literally weekly about XDR features not working, buggy, etc.

At this point I'm submitting 3 a week...

I have a client (I work at an MSP) who operates several sites with OT equipment, and are interested in Defender for OT.

Does anyone here have much experience with deploying it, running it on a day-to-day basis, and any feelings about how effective it is as a platform.

We're currently comparing it with other OT tools such as CrowdStrike and Tenable OT.

Thanks in advance!

Microsoft has introduced a dedicated Microsoft Defender AI agent runtime protection setting in Intune.
Microsoft Intune → Endpoint security → Antivirus

Administrators can now centrally configure and deploy AI agent runtime protection to supported Windows devices using
◈ Audit mode – Detect and report prompt injection attempts.
◈  Block mode – Detect and block supported malicious agent actions.

Important to know: Protection is disabled by default.

The Intune profile currently supports agent-native event inspection.

Network inspection still requires separate configuration using PowerShell.

Title:
Hi everyone,
I’m trying to create a custom detection in Microsoft Defender XDR that triggers an alert when Windows Event ID 7040 occurs with specific text in the event message.
I’ve tried several KQL queries against DeviceEvents, but I can’t find the event at all, let alone filter on its message. Am I looking in the wrong table, or is this event simply not collected by Defender for Endpoint?
Has anyone managed to do this, either with a working KQL query or another practical monitoring solution?
I’ve seen suggestions to deploy an event-triggered scheduled task through GPO, but that feels like quite a bit of overhead for a relatively simple requirement. Ideally, I’d like to handle it centrally through Defender.
Any advice or examples would be appreciated. Thanks for your help, sharing makes this community better.

P.S. To clarify, Event ID 7040 records changes to a service’s startup type, for example, from Automatic to Manual, or vice versa. My goal is to get an alert whenever the startup type of a specific service is changed.

We are evaluating Microsoft Defender Vulnerability Management for a mixed Windows and macOS environment. I’m looking to speak with administrators who use it day to day—not just people who have completed a trial.

I’m particularly interested in vulnerability accuracy, macOS coverage, third-party application visibility, remediation workflows, monthly reporting, email notifications, licensing and the amount of administrative work required.

If you currently manage MDVM and would be willing to share your experience through messages or a short call, I would appreciate it. No vendor or sales responses, please.

Hello,

MS 365 Defender produces way too many FPs even on Windows, but there I can at least submit file samples through WDSI portal. Then MS analysis lab either removes the detection right away or says they cannot reproduce alert and submit MPSupportFilesCAB diagnostic result if I want an investigation conducted. I do so, they check the debug logs and fix the FP. Not an ideal situation, but it works.

However, for Linux and MacOS false positive sample submissions, the lab ALWAYS responds with "cannot reproduce detection" and submit mpsupportfiles CAB diagnostic result if I want an investigation. Of course, CAB archives are a Windows-only format, so I can't do that!

Instead, I pull Apple ZIP or Linux TAR-GZ diagnostics via the Live Response "collect" command. Regrettably MS lab always responds to those submissions with "cannot reproduce detection" or "submitted archive doesn't contain the detected objects" or other non-sensical excuse.

MS lab apparently lacks non-Windows analysts or my submissions never reach the higher band analysts who know what to do with Linux and MacOS cases? What can I do to get those FPs fixed as well? Thanks in advance!

Anyone ran into this? I am GA on the tenant so unsure if it's a backend issue or otherwise. (Pic attached)

I'm looking for some advice regarding Microsoft Defender for Endpoint (MDE) telemetry coverage.

As part of our Threat Hunting programme, we've been testing a number of KQL queries to better understand MDE's telemetry coverage and identify areas where detections may need further tuning.

Using Atomic Red Team tests and other scripts within a dedicated testing environment, we've identified what appears to be a gap in telemetry collection for certain interactively executed PowerShell commands.

For example, when PowerShell or PowerShell ISE is launched and commands are executed interactively, we do not always receive the full cmdlet or script content within MDE telemetry. This makes it difficult to accurately detect, investigate and hunt for the activity using Advanced Hunting.

During our research, we came across the following Microsoft discussion:

🔗 Microsoft Defender ATP - Advanced Hunting Query PowerShell Command Line

The recommendation in that thread is to enable PowerShell Script Block Logging. However, in our testing, enabling Script Block Logging does not appear to resolve the issue. The PowerShell activity is visible locally within Event Viewer, but the corresponding telemetry does not seem to be forwarded into MDE.

Has anyone else encountered this limitation?

I'm particularly interested in understanding:

• Whether this is expected behaviour within MDE
• If there are additional configuration requirements beyond Script Block Logging
• Whether others have found alternative telemetry sources or hunting approaches to capture this activity more reliably

Any insights, experiences or recommendations would be greatly appreciated.

Bonjour à tous,

Je suis actuellement en Bac+3 Cybersécurité à Guardia Cybersecurity School, après avoir obtenu un BTS CRSA orienté automatisme et systèmes industriels.

Mon objectif est de me diriger vers la cybersécurité industrielle / OT, notamment autour des réseaux industriels, automates, systèmes de supervision et sécurité des environnements industriels.

Je cherche actuellement une alternance en Île-de-France pour ma première expérience professionnelle dans ce domaine.

Je travaille déjà de mon côté sur Linux, les réseaux, le routing, les pare-feu, les CTF, Root-Me, TryHackMe et Fortinet.

Pour ceux qui travaillent dans l'industrie, l'automatisme ou la cybersécurité industrielle : comment avez-vous trouvé votre première opportunité dans ce domaine ? Est-ce qu'il y a des entreprises ou types de postes que vous me conseilleriez de cibler ?

Merci d'avance pour vos conseils.

I’m the IT lead for a 120-person company on Microsoft 365. We recently found a sales rep who had been downloading our customer database to a personal OneDrive.

We had Purview turned on for months. It generated plenty of alerts about external Word doc shares, but nothing on this case. The rep had been with us four years. His OneDrive sync stayed active for 11 days after the termination date. From the Microsoft side the activity looked like normal use of his own account. The signal that stood out was a terminated identity in the IdP still making high-volume API calls.

I’m trying to build a more reliable way to catch this kind of post-termination activity. What does your actual workflow look like for spotting terminated users who still have live OneDrive or similar syncs running? Looking for practical detection and response steps.

Instead of building a full Logic App or playbook, you can select a trigger and attach a predefined action directly in Defender.

Some of the available capabilities include:
◈ Trigger automation when a case is created or updated
◈ Send case creation / update email notifications
◈ Automatically update case properties
◈ Create investigation tasks
◈ Update alerts directly from the automation workflow

Docs: Create basic automation rules with Simple Flows in the Microsoft Defender portal (preview) | Microsoft Learn

We're replacing our MDR and I'd like to hear from people who've lived with theirs, not from sales decks.

Where we are

- About 1,000 users across 15 sites globally, in manufacturing
- The stack decision is made: Defender XDR, MDE on everything that takes an agent, Defender for Servers covering on-prem and AWS Linux, and Sentinel for longer retention and some third-party logs
- Firewall refresh coming, probably Palo or Fortinet
- Small internal team, no in-house 24/7 SOC

Why we're leaving

Our current provider mostly relays alerts. They can't act on our EDR, and "response" means an email telling us to go do something. I want a provider that will isolate a host, disable an account, or revoke sessions at 3am under runbooks we've approved ahead of time.

What I'm weighing

Microsoft's own Defender Experts is on the list, but the licensing gets complicated at our size. Plan 2 has a 1,500-seat minimum, and servers are a separate SKU. So I'm also looking at third-party MDRs that work natively in Defender. I haven't settled on either path, and I'm open to being talked out of my assumptions.

What I'd really like to know

1. Who's your MDR, and would you renew? Why or why not?
2. Do they actually take response actions in your tenant, or do they mostly escalate?
3. How's their coverage outside US hours? Real follow-the-sun, or a thin overnight crew?
4. Do their detections live in your Sentinel or in their own platform? Has that made switching providers painful?
5. If you've used Defender Experts, how did it compare to a third party?
6. Anyone you'd tell me to stay away from?

Vendors, feel free to DM me. I'm more interested in hearing from customers in the thread.

Our Sentinel Logic App playbooks post enrichment comments to incidents using basic HTML (bold tags, line breaks). Up until roughly Sept 23 these rendered fine in the Defender portal incident page. Now they show as flat text: no bold, no line breaks, everything on one line.
Same comments still render correctly in Sentinel in the Azure portal, and the playbook runs are succeeding, so this looks like a portal rendering change rather than anything on our side.

Timing lines up with the Incident Cases preview (MC1477993). The docs for the legacy incident page were updated the same day and still say the comment field supports formatting, but I can't find anything that mentions a change to how comments render.

Tested manually as well: a hand-typed comment containing HTML tags and markdown bold shows the tags and asterisks literally, so neither renders.

Anyone else seeing this, or found a format that still renders in the new incident page?

We installed Defender for Identity v2 on 4 Domain controllers over 3 weeks ago.

For some reason i still don't see any single alert triggered in Defender console that is from Defender for Identity. The Thresholds are all set to High (default).

It this quite normal?

I'm having an issue with Defender for Identity and cannot submit a support request through the Defender portal as the AI auto closes the ticket, tells me it's an Azure issue, and directs me to the Azure support portal.

You would think a product with "Defender For..." in the title should be covered by Defender support? I also cannot submit an Azure support request as it forces me to choose an Azure subscription, which they don't have and is completely unrelated to DFI.

How can I get the Defender support team to take this request?

(The specific issue I have is Global health issues across all sensors for incorrect auditing set up, which I have set up correctly, and the DFI PowerShell module even tells me it is correctly configured on each server)

So i'm playing fc 27 and then a message pops up from defender that it has blocked a threat (as you can see in the picture its in german) for non germans it says that the programm is dangerous and It executes an attacker's commands. I already had it in fc 26 but because its also in fc 27 i'm a little concerned. Thanks in advance!

The idea is to move beyond treating SIEM, XDR, automation and AI-assisted investigation as separate layers.

With Integrated Security Operations Center (ISOC), Microsoft is bringing them together around a common security operations foundation:

• SIEM + XDR capabilities
• Unified security signals and context
• Investigation and threat hunting
• Automated response
• Security agents working alongside analysts
• Incident management and protective actions

Instead of AI being primarily an assistant that analysts invoke during an investigation, Microsoft is moving toward security agents operating continuously within the SOC workflow — using shared context, coordinating actions and escalating decisions to human analysts where necessary.

Docs: Integrated Security Operations Center (ISOC) in Microsoft Defender - Microsoft Defender XDR | Microsoft Learn

I'm currently working on building a custom Microsoft Security Copilot agent that acts as a Tier-2 SOC analyst and performs automated investigations for alerts originating from Microsoft Defender XDR, Microsoft Sentinel, and related security products.

Currently, I'm struggling with defining the best structure for agent instructions and deciding how granular the investigation workflow should be.

Has anyone successfully implemented a Security Copilot custom agent for automated incident investigation ?

Hey, I’m having issues with Windows Defender. I’m trying to run an app that keeps getting blocked as a threat. I cannot disable it or allow the threat on Windows Security settings because it doesn't show up. I've tried several PowerShell codes and restarted, but nothing changes.