Monthly news - January 2024

"Defender Boxed" is back! During January you can get your personalized SOC summary via Defender Boxed. 

Go to the Defender portal, and open the incident page.

Defender Boxed

Microsoft Defender XDR unified role-based access control (RBAC) model is now generally available. 

We have continuously enhanced and expanded the unified RBAC model in Microsoft Defender XDR, and now we are excited to share the general availability of Microsoft Defender XDR unified RBAC model as well as the latest capabilities to further simplify permission management.

The Microsoft Defender portal's incident queue has updated filters, search, and added a new function where you can create your own filter sets. For details, see Available filters.

You can now assign incidents to a user group or another user. For details, see Assign an incident.

Investigating malicious OAuth applications using the Unified Audit Log. This blog post provides additional guidance for incident responders on investigating cloud solution providers.

Data retention in Microsoft 365 and Microsoft Entra ID

Microsoft Defender Experts for XDR now lets you exclude devices and users from remediation actions taken by our experts and instead get remediation guidance for those entities.

Public Preview of Apple User Enrollment support for Defender for Endpoint on iOS. This new feature offers security and IT teams the flexibility to deploy Defender for Endpoint to user-enrolled devices so that work data and applications are protected, while end-user privacy is upheld on those devices. 

New Identities area and dashboard in Microsoft Defender XDR (Preview). 

In Microsoft Defender XDR, select Identities to see any of the following new pages:

• Dashboard: Shows graphs and widgets to help you monitor identity threat detection and response activities. For more information, see Work with Defender for Identity's ITDR dashboard.

   

• Health issues: Now moved from the Settings > Identities area, and lists any current health issues for your general Defender for Identity deployment and specific sensors. For more information, see Microsoft Defender for Identity sensor health issues.

• Tools: Links to helpful information and resources when working with Defender for Identity, including links to documentation, specifically on the capacity planning tool, and the Test-MdiReadiness.ps1 script.

In August we unveiled our newest Microsoft Defender for Identity sensor specifically designed for Active Directory Certificate Services (AD CS) servers to help our customers gain even more visibility into this critical piece of Identity infrastructure. This blog post discusses some of the AD CS abuse techniques outlined in "Certified Pre-Owned" (by Will Schroeder and Lee Christensen) and gives insight into the upcoming Defender for Identity capabilities designed to help address them. 

Security posture assessments for AD CS sensors (Preview). Learn more here. 

We are thrilled to share that the Defender for Cloud Apps discovery capabilities (extension to over 400 Generative AI apps) is now generally available. To help companies navigate the sprawl of Generative AI apps and provide ways to enable users to safely interact with these apps without sacrificing productivity, we announced at Ignite that Defender for Cloud Apps and Microsoft Purview released new capabilities to help organizations to secure the use of AI. 

Discovered apps filtered on the “Generative AI,” category

• Atlassian
• Dropbox
• NetDocuments
• Workplace
• Zendesk

SSPM is also now supported for Google Workspace in General Availability. 

For more information, see: SaaS security posture management (SSPM)

 column during the update process. As the update progresses the bar shows the percentage of the update completed, showing you that the process is ongoing, is not stuck or has failed. 

For more information, see Update Defender for IoT OT monitoring software.

When integrating with Microsoft Sentinel, the Microsoft Sentinel SecurityAlert table is now updated immediately only for changes in alert status and severity. Other changes in alerts, such as last detection of an existing alert, are aggregated over several hours and display only the latest change made.

For more information, see Understand multiple records per alert.