1. Automated Response with Windows Defender ATP
9/12/2018 6:09 AM
BRK3062
Automated Response with Windows Defender ATP
Heike Ritter
Sr. Product Manager
@HeikeRitter
Nathan Burke
VP Marketing, Hexadite
@nathanwburke
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Outline What is Windows Defender ATP? Detecting Attacks
9/12/2018 6:09 AM
Outline
What is Windows Defender ATP?
What is EDR/EPP?
Detecting Attacks
A Blessing and a Curse
The Cybersecurity Capacity Problem
Increase in Attack Volume
Increase in Alerts
Shortage of Skilled Security Staff
What is Security Automation?
How Companies Address the Challenges
Case Study: Nuance Communications
What’s Coming to WDATP?
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

3. What is Windows Defender ATP ?
9/12/2018
What is Windows Defender ATP ?
Unified endpoint security solution with Windows 10 threat & endpoint protection and response under one roof
Security Analytics
Enhanced detection – Application Guard, Exploit Guard, script introspection
Windows Security Graph APIs
Windows Server support
Enhanced detection - memory, injection, kernel, visibility to Windows Defender AV detections
Response actions
Custom Threat Intelligence
Detection and exploration integration with Office 365 ATP
Behavior-based, cloud-powered EDR solution
Built into Windows 10, agentless and no deployment
Rich timeline for investigation & interactive hunting
Unparalleled threat optics and deep OS security and big data expertise
Anniversary Update
Creators Update
Fall Creators Update
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4. 9/12/2018 6:09 AM
What Do Customers Get?
Security teams now have a single console to centrally manage the end-to-end security lifecycle for their devices.
As a key component of the Microsoft 365 security stack, Windows Defender ATP brings together detection and investigations across devices, identities, and information.
Customers now have more visibility into threats than ever before.
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. 9/12/2018 6:09 AM
970,000,000 Windows Defender ATP processes 970 million malicious security events per day per day from across the Microsoft enterprise and consumer eco-system.
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6. Cybersecurity has a capacity problem.
9/12/2018 6:09 AM
Cybersecurity has a capacity problem.
By Nevit Dilmen (Own work) via Wikimedia Commons
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

7. 9/12/2018 6:09 AM
Prioritization is just a conscious decision about what you’re willing to ignore.
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

8. 9/12/2018 6:09 AM By Nathan Burke (own work)
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9. What is Security Automation?
9/12/2018 6:09 AM
What is Security Automation?
Mimicking the ideal steps a human would take to investigate a cyber threat.
Determining whether the threat requires action.
Performing necessary remediation actions.
Deciding what additional investigations should be next.
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10. “Security automation is preventing people from doing a machine’s job.”
Golan Ben-Oni
Global CIO
IDT Corp.

11. Automated Response Demo
9/12/2018 6:09 AM
Automated Response Demo
New Functionality Coming to Windows Defender ATP
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12. 9/12/2018 6:09 AM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

20. Please evaluate this session
Tech Ready 15
9/12/2018
Please evaluate this session
From your
Please expand notes window at bottom of slide and read. Then Delete this text box.
PC or tablet: visit MyIgnite
Phone: download and use the Microsoft Ignite mobile app
Your input is important!
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

21. 9/12/2018 6:09 AM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.