Microsoft Defender and detection
Good security spots an attack in time. I set up Microsoft Defender for your devices, email, identities, cloud apps and Azure, and advise on monitoring, detection and what to do when something does go wrong.
When is this for you?
- You have Microsoft 365 E3, E5 or Business Premium but only use half of the security features
- You receive alerts, but nobody knows what to do with them
- You want to stop phishing and ransomware more effectively
- You want to show you can handle incidents, for example for NIS2
My approach
Current situation
Which licences and Defender components do you have, and what's already enabled? Secure Score is the starting point.
Design and baseline
I set up the policies: device onboarding, attack surface reduction rules, anti-phishing, and safe attachments and links.
Phased rollout
First in audit mode to see what happens, then blocking step by step. That way work doesn't grind to a halt.
Monitoring and incident response
Alerts to the right people, clear agreements and a runbook: who does what during an incident? If you like, we practise it with a tabletop exercise.
Handover
Documentation and explanation for your administrators, so your team can manage it themselves.
What you get
- Configured Defender policies for devices, email and identities
- A higher Secure Score with an explanation per measure
- Alerting to the right people
- An incident response runbook
- Documentation for operations
My experience
I configure every part of Microsoft Defender for a wide range of organisations and advise on monitoring, detection and incident response. I'm certified as a Security Operations Analyst (SC-200) and Azure Security Engineer (AZ-500).
Shall we talk?
Would you like a website, or help with your cloud environment? Send me a message.