1. 12/1/ :04 AM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Threat Protection with Microsoft Advanced Threat Protection
12/1/ :04 AM
BRK2086
Threat Protection with Microsoft Advanced Threat Protection
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

3. Session objectives Meet Azure Advanced Threat Protection (=Azure ATP)
12/1/ :04 AM
Session objectives
Meet Azure Advanced Threat Protection (=Azure ATP)
See a bunch of demos
Enjoy! 
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4. IT is changing
Identity
Devices
Apps
Data
On-premises

5. “Hybrid” is changing the security perimeter
OPPORTUNITY
On-premises

6. The Microsoft Security Model
Combined Microsoft Stack:
Maximize detection coverage throughout the attack stages
Office 365 ATP
Windows ATP
ATA
End Point
User

7. The Microsoft Security Model
Combined Microsoft Stack:
Maximize detection coverage throughout the attack stages
Office 365 ATP
Windows ATP
ATA
End Point
User
User receives an
Opens an attachment
Clicks on a URL
Exploitation
Office 365 ATP
protection
User browses to a website
User runs a program

8. The Microsoft Security Model
Combined Microsoft Stack:
Maximize detection coverage throughout the attack stages
Office 365 ATP
Windows ATP
ATA
End Point
User
User receives an
Opens an attachment
Clicks on a URL
Exploitation
Installation
C&C channel
Office 365 ATP
Windows Defender ATP
protection
End Point protection
User browses to a website
User runs a program

9. The Microsoft Security Model
Combined Microsoft Stack:
Maximize detection coverage throughout the attack stages
Office 365 ATP
Windows ATP
ATA
End Point
User
User receives an
Opens an attachment
Clicks on a URL
Exploitation
Installation
C&C channel
Reconnaissance
Lateral Movement
Domain Dominance
Brute force an account
Office 365 ATP
Windows Defender ATP
protection
End Point protection
User browses to a website
User runs a program

10. The Microsoft Security Model
Combined Microsoft Stack:
Maximize detection coverage throughout the attack stages
Office 365 ATP
Windows ATP
ATA
End Point
User
User receives an
Opens an attachment
Clicks on a URL
Exploitation
Installation
C&C channel
Reconnaissance
Lateral Movement
Domain Dominance
Brute force an account
Office 365 ATP
Windows Defender ATP
protection
End Point protection
Azure ATP
Identity protection
User browses to a website
User runs a program

11. Introducing
Detect advanced attacks in your on-premises, cloud and hybrid environments
Azure ATP
APPS
APPS

12. ! 1 Collect Analyze & Learn 2 Detect 3 Alert & Investigate 4
12/1/ :04 AM 1
Collect
Port Mirroring or Sensor on DC
L7 Deep Packet Inspection (DPI)
Hybrid data sources 2
Analyze & Learn
Self-learning and profiling technology
Patented IP resolution mechanism
Unlimited scale powered by Azure !
Detect 3
Abnormal behavior and suspicious activities
Real-breach oriented research
Microsoft Intelligence
Alert & Investigate 4
Intuitive attack timeline
Quick triaging of alerts
Investigate via the dedicated Profile Page or Windows Defender ATP
Azure ATPSENSOR
PROXY
VPN AD HR
APPS
ADFS
SIEM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

13. Demo #1 Azure ATP Deployment and Configuration 12/1/2018 10:04 AM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

14. Demo #1 recap Create Workspace Connect to Active Directory
12/1/ :04 AM
Demo #1 recap
Create Workspace
Connect to Active Directory
Install first Sensor
Setup notifications
Schedule a summary report
Configure Honeytoken user
Tag Sensitive users and groups
Windows Defender ATP integration
Other recommended steps?  Yes! SIEM and VPN data integration.
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

15. The new Sensor Gateway  Sensor New parsing platform
12/1/ :04 AM
The new Sensor
Gateway  Sensor
New parsing platform
Performance improvement x10
CPU Memory
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. Demo #2 Attack Simulations and Azure ATP Detections 12/1/2018 10:04 AM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

17. Demo #2 recap Realtime Detections
12/1/ :04 AM
Demo #2 recap
Realtime Detections
“Password Spray” Brute Force
Abnormal Sensitive group modifications
Investigating with Windows Defender ATP
Reports
Sensitive group modifications
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

18. Azure ATP Detect advanced
attacks in your on-premises, cloud and hybrid environments
Detect advanced attacks in your on-premises, cloud and hybrid environments
Azure ATP
APPS
APPS

19. Announcing the Limited Preview!
12/1/ :04 AM
Announcing the Limited Preview!
Easy to deploy and get running
Minimal impact - new Sensor & Azure service
Start using Windows Defender ATP integration immediately
Looking for your feedback!
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

20. 12/1/ :04 AM
Q&A
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

21. 12/1/ :04 AM
Thank You!
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

22. 12/1/ :04 AM
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.