Build a comprehensive, layered detection policy stack in Microsoft Defender for Endpoint. Configure next-generation antivirus, EDR in block mode, custom indicators of compromise, RBAC for SOC tiers, automated investigation levels, web content filtering, device control, tamper protection, network protection, and custom detection rules with KQL.
Microsoft Defender for Endpoint provides a rich set of configurable detection and response policies that work together as a layered defense stack. This lab covers end-to-end deployment: next-generation antivirus via Intune, EDR in block mode, custom indicators, RBAC, and automated investigation and response (AIR). You will also configure supporting protections: web content filtering, device control for removable media, tamper protection, and network protection. Finally, you will build custom detection rules using KQL and validate the entire policy stack with simulated attacks.
Scenario: A global financial services firm operates 15,000 endpoints across North America, Europe, and Asia-Pacific.
The CISO has mandated a unified detection policy framework that balances security coverage with operational stability. SOC Tier 1 analysts need read-only access, Tier 2 analysts need response capabilities, and Tier 3 engineers need full configuration access. Regulatory requirements (PCI-DSS, SOX, GDPR) mandate USB device control, web filtering, and automated investigation documentation.
Success criteria: zero policy gaps across all device groups, RBAC aligned to SOC tiers, automated investigation enabled for high-confidence alerts, and a detection effectiveness dashboard.
Misconfigured detection policies are the leading cause of alert blind spots; organizations frequently deploy MDE without tuning defaults. Layered detection reduces dwell time: next-gen AV catches known threats, EDR catches behavioral anomalies, and custom rules target organization-specific risks. RBAC enforcement ensures least-privilege access, preventing accidental or unauthorized configuration changes in production. Automated investigation accelerates mean time to respond (MTTR) by eliminating manual triage for high-confidence alerts.
Before configuring policies, understand how MDE's detection layers work together. Each layer addresses a different phase of the threat lifecycle.
# ---------------------------------------------------------
# WHAT: Audit the current Defender AV configuration on a device
# WHY: Before deploying new detection policies, baseline what's
# already configured. Inconsistencies across devices indicate
# policy gaps or conflicting Intune/GPO configurations.
# ---------------------------------------------------------
# Review protection settings
# DisableRealtimeMonitoring: $false = real-time scanning ON (required)
# DisableBehaviorMonitoring: $false = behavior detection ON (required)
# MAPSReporting: 0=Off, 1=Basic, 2=Advanced (target: 2 for full cloud)
# SubmitSamplesConsent: 0=Prompt, 1=Safe, 2=Never, 3=All (target: 3)
# CloudBlockLevel: 0=Default, 2=High, 4=High+, 6=Zero tolerance
# CloudExtendedTimeout: Seconds to wait for cloud verdict (target: 50)
# EnableNetworkProtection: 0=Off, 1=Block, 2=Audit
# EnableControlledFolderAccess: 0=Off, 1=Block, 2=Audit
# PUAProtection: 0=Off, 1=Block, 2=Audit
Get-MpPreference | Select-Object `
DisableRealtimeMonitoring,
DisableBehaviorMonitoring,
MAPSReporting,
SubmitSamplesConsent,
CloudBlockLevel,
CloudExtendedTimeout,
EnableNetworkProtection,
EnableControlledFolderAccess,
PUAProtection
# Check AV engine and signature versions
# WHY: Outdated engines may lack detection capabilities for new threats.
# AMProductVersion = Defender platform version (e.g., 4.18.x)
# AMEngineVersion = AV engine version (updated with platform)
# AntispywareSignatureVersion = signature/definition version
# AntivirusSignatureLastUpdated = should be within last 24 hours
Get-MpComputerStatus | Select-Object `
AMProductVersion,
AMEngineVersion,
AntispywareSignatureVersion,
AntivirusSignatureLastUpdated,
RealTimeProtectionEnabled,
BehaviorMonitorEnabledDeploy a centrally managed antivirus policy through Microsoft Intune to ensure consistent protection settings across all endpoint groups.
Cloud-delivered protection sends suspicious files to Microsoft's cloud for detonation and machine learning analysis. Block-at-first-sight stops unknown threats within seconds of first encounter.
# ---------------------------------------------------------
# WHAT: Verify and configure cloud-delivered protection settings
# WHY: Cloud protection sends suspicious files to Microsoft's
# detonation sandbox for ML analysis. Block-at-first-sight
# stops zero-day threats within seconds of first encounter.
# ---------------------------------------------------------
# Verify current cloud protection settings
Get-MpPreference | Select-Object `
MAPSReporting,
SubmitSamplesConsent,
CloudBlockLevel,
CloudExtendedTimeout
# EXPECTED VALUES for maximum protection:
# MAPSReporting : 2 (Advanced) - sends full file metadata to cloud
# SubmitSamplesConsent : 3 (Send all samples automatically)
# CloudBlockLevel : 6 (High+ / Zero Tolerance) - most aggressive blocking
# CloudExtendedTimeout : 50 (seconds to wait for cloud verdict before allowing)
# Configure directly via PowerShell if Intune policy hasn't applied yet
# NOTE: Intune-managed settings will override these on next policy sync.
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent SendAllSamples
Set-MpPreference -CloudBlockLevel 6
Set-MpPreference -CloudExtendedTimeout 50EDR in block mode allows MDE to take automated blocking and remediation actions on post-breach detections, even when a third-party antivirus is installed. It acts as a safety net when the primary AV misses a threat.
// ---------------------------------------------------------
// WHAT: Find all EDR in block mode remediation actions
// WHY: EDR block mode acts as a safety net - it blocks threats
// that the primary AV missed, using behavioral detection.
// Tracking these events quantifies the value of EDR block mode.
// TABLE: DeviceEvents - ActionType "AntivirusDetection" with
// IsEdrInBlockMode flag in AdditionalFields.
// KEY FIELDS:
// ThreatName = the malware family/variant detected post-breach
// WasRemediated = whether the threat was successfully cleaned
// IsEdrBlockMode = true when EDR (not AV) triggered the block
// OUTPUT: Threat names ranked by block count - evidence that
// EDR block mode is catching threats the primary AV missed.
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType == "AntivirusDetection"
| extend ParsedFields = parse_json(AdditionalFields)
| extend ThreatName = tostring(ParsedFields.ThreatName),
WasRemediated = tobool(ParsedFields.WasRemediated),
IsEdrBlockMode = tobool(ParsedFields.IsEdrInBlockMode)
| where IsEdrBlockMode == true
| summarize BlockedCount = count(),
UniqueThreats = dcount(ThreatName),
AffectedDevices = dcount(DeviceName)
by ThreatName, WasRemediated
| sort by BlockedCount descCustom indicators extend MDE detection beyond global threat intelligence. Create organization-specific blocks or alerts for known-bad file hashes, IP addresses, URLs, and certificates.
// ---------------------------------------------------------
// WHAT: Find all alerts triggered by custom indicators (IoCs)
// WHY: Measures the effectiveness of your organization-specific
// threat intelligence - custom file hashes, IPs, URLs, and
// certificates that you imported into MDE.
// TABLES: AlertInfo (alert metadata) joined with AlertEvidence
// (files, processes, IPs associated with the alert).
// DETECTION SOURCES:
// "CustomDetection" = KQL custom detection rules
// "CustomerTI" = Custom Indicators (file hash, IP, URL, cert)
// OUTPUT: Which indicators are hitting, how often, and severity.
// Low hit counts may indicate stale IoCs that need removal.
// ---------------------------------------------------------
AlertInfo
| where Timestamp > ago(30d)
| where DetectionSource == "CustomDetection"
or DetectionSource == "CustomerTI"
| join kind=inner AlertEvidence on AlertId
| summarize HitCount = count(),
AffectedDevices = dcount(DeviceId),
IndicatorValues = make_set(FileName)
by Title, Severity, DetectionSource
| sort by HitCount descDevice groups determine how policies, RBAC permissions, and automated investigation levels are applied. Use tag-based membership for dynamic, scalable grouping.
HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\DeviceTagging\GroupRBAC ensures that SOC analysts only access the devices and actions appropriate for their tier. This prevents configuration drift and supports audit compliance.
Automated Investigation and Response enables MDE to automatically investigate alerts and remediate threats without analyst intervention. Configure the automation level per device group based on risk tolerance.
// ---------------------------------------------------------
// WHAT: Review automated investigation (AIR) outcomes by severity
// WHY: Measures how effectively AIR is handling alerts without
// human intervention. A high AutoRemediationRate indicates
// well-tuned automation; low rates suggest configuration gaps.
// TABLES: AlertInfo joined with AlertEvidence on AlertId.
// KEY FIELDS:
// AttackTechniques: MITRE ATT&CK techniques (non-empty = mapped)
// RemediationStatus: "Remediated" | "PendingApproval" | "Failed"
// LOGIC: Calculates auto-remediation rate as a percentage.
// Target: > 80% for standard workstation device groups.
// OUTPUT: One row per severity level with counts and rates.
// PendingApproval build-up = need more Tier 2 analysts or
// adjust automation level to "Full" for that device group.
// ---------------------------------------------------------
AlertInfo
| where Timestamp > ago(30d)
| where isnotempty(AttackTechniques)
| join kind=inner (
AlertEvidence
| where Timestamp > ago(30d)
| where isnotempty(RemediationStatus)
) on AlertId
| summarize TotalAlerts = dcount(AlertId),
AutoRemediated = dcountif(AlertId, RemediationStatus == "Remediated"),
PendingApproval = dcountif(AlertId, RemediationStatus == "PendingApproval"),
Failed = dcountif(AlertId, RemediationStatus == "Failed")
by Severity
| extend AutoRemediationRate = round(100.0 * AutoRemediated / TotalAlerts, 1)
| sort by SeverityWeb content filtering blocks access to websites based on category, reducing attack surface from drive-by downloads, phishing sites, and malicious content hosting.
Device control restricts USB and removable media access to prevent data exfiltration and block USB-based malware delivery. Configure granular policies that allow approved devices while blocking unauthorized ones.
# ---------------------------------------------------------
# WHAT: Review device control events for USB/removable media
# WHY: Device control policies generate events when users connect
# removable storage devices. Monitoring these events helps
# validate policy enforcement and detect shadow IT.
# EVENT IDs in the Defender Operational log:
# 1123 = Removable storage BLOCKED (block mode active)
# 1124 = Removable storage AUDITED (audit mode, logged only)
# 1125 = Removable storage policy APPLIED to device
# ---------------------------------------------------------
Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" |
Where-Object { $_.Id -in @(1123, 1124, 1125) } |
Select-Object -First 20 TimeCreated, Id, Message |
Format-Table -AutoSize
# Event ID 1123: Blocked removable storage event
# Event ID 1124: Audit removable storage event
# Event ID 1125: Removable storage policy appliedTamper protection prevents malicious actors or unauthorized users from disabling Microsoft Defender Antivirus, real-time protection, cloud-delivered protection, and other security features.
# ---------------------------------------------------------
# WHAT: Verify tamper protection status on the local device
# WHY: Tamper protection prevents attackers (and local admins)
# from disabling Defender AV security features.
# When active, attempts to disable protections are denied.
# ---------------------------------------------------------
# Check tamper protection and real-time protection status
# IsTamperProtected: True = tamper protection active (security settings locked)
# RealTimeProtectionEnabled: True = file scanning is active
Get-MpComputerStatus | Select-Object IsTamperProtected, RealTimeProtectionEnabled
# Expected output when tamper protection is active:
# IsTamperProtected : True
# RealTimeProtectionEnabled : True
# TEST: Attempt to disable real-time protection (should FAIL)
# WHY: Validates that tamper protection is actually enforcing.
# EXPECTED: Error "This setting is managed by your administrator"
Set-MpPreference -DisableRealtimeMonitoring $true
# Expected: This setting is managed by your administratorNetwork protection extends SmartScreen protection to all HTTP/HTTPS traffic on the device, blocking outbound connections to malicious or suspicious destinations regardless of the browser or application used.
# ---------------------------------------------------------
# WHAT: Configure and verify network protection
# WHY: Network protection extends SmartScreen to ALL HTTP/HTTPS
# traffic (not just Edge). Blocks outbound connections to
# malicious domains, C2 infrastructure, and phishing sites.
# Required for web content filtering on non-Edge browsers.
# MITRE: Blocks T1071 (Application Layer Protocol) C2 channels.
# ---------------------------------------------------------
# Enable network protection in block mode (enforced)
# VALUE: Enabled = block malicious connections; AuditMode = log only
Set-MpPreference -EnableNetworkProtection Enabled
# Verify current network protection status
# OUTPUT: 0 = Disabled, 1 = Enabled (Block), 2 = Audit
Get-MpPreference | Select-Object EnableNetworkProtection
# Start in audit mode first (recommended for initial deployment)
# WHY: Logs blocked connections without disrupting users. Review
# logs for false positives before switching to Block.
Set-MpPreference -EnableNetworkProtection AuditMode
# Test network protection by accessing Microsoft's SmartScreen test URL
# WHY: This URL is safe but classified as malicious for testing.
# Block mode = browser shows block page; Audit mode = logged only.
Start-Process "https://smartscreentestratings2.net"Custom detection rules use KQL queries to automatically detect suspicious activity and generate alerts or take response actions. Build rules for threats specific to your organization.
// ---------------------------------------------------------
// WHAT: Custom detection rule - LSASS credential access
// WHY: Detects credential dumping tools (Mimikatz, ProcDump,
// pypykatz) targeting the LSASS process to extract
// passwords, NTLM hashes, and Kerberos tickets.
// MITRE: T1003.001 (OS Credential Dumping: LSASS Memory)
// DETECTION LOGIC:
// Matches known credential dumping tool names OR any process
// whose command line references "lsass" with dump-related keywords.
// Excludes SYSTEM/LOCAL SERVICE/NETWORK SERVICE accounts as
// they legitimately interact with LSASS.
// TRUE POSITIVE: Mimikatz, ProcDump with -ma lsass, pypykatz.
// FALSE POSITIVE: Some EDR agents or monitoring tools may access LSASS.
// Verify InitiatingProcessFileName before adding exclusions.
// FREQUENCY: Every 1 hour for near-real-time detection.
// RESPONSE: Auto-isolate the device and collect investigation package.
// ---------------------------------------------------------
DeviceProcessEvents
| where Timestamp > ago(1h)
| where FileName in~ ("procdump.exe", "procdump64.exe", "mimikatz.exe", "pypykatz.exe")
or (ProcessCommandLine has "lsass" and ProcessCommandLine has_any ("dump", "minidump", "sekurlsa"))
| where InitiatingProcessAccountName !in ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")
| project Timestamp, DeviceId, DeviceName, FileName,
ProcessCommandLine, AccountName,
InitiatingProcessFileName, ReportId// ---------------------------------------------------------
// WHAT: Custom detection rule - Suspicious PowerShell execution
// WHY: Encoded PowerShell and download cradles are the #1 delivery
// mechanism for malware payloads, including ransomware,
// Cobalt Strike beacons, and reverse shells.
// MITRE: T1059.001 (Command and Scripting Interpreter: PowerShell)
// T1105 (Ingress Tool Transfer) for download behavior.
// DETECTION LOGIC:
// Matches powershell.exe or pwsh.exe with suspicious command-line
// patterns: encoded commands (-enc), Base64 decoding, web downloads,
// or dynamic code execution (IEX/Invoke-Expression).
// EXCLUSIONS:
// SCCM (CCM) and Intune management agents are excluded because
// they legitimately use encoded PowerShell for policy delivery.
// UPDATE THESE EXCLUSIONS for your environment's management tools.
// TRUE POSITIVE: Encoded download cradle from unknown parent process.
// FALSE POSITIVE: IT automation scripts using Invoke-WebRequest.
// Check InitiatingProcessFileName for context.
// FREQUENCY: Every 1 hour.
// ---------------------------------------------------------
DeviceProcessEvents
| where Timestamp > ago(1h)
| where FileName =~ "powershell.exe" or FileName =~ "pwsh.exe"
| where ProcessCommandLine has_any (
"-EncodedCommand", "-enc ", "-e ",
"FromBase64String", "DownloadString",
"DownloadFile", "Invoke-WebRequest",
"IEX", "Invoke-Expression"
)
| where ProcessCommandLine !has "Windows\\CCM" // Exclude SCCM
| where ProcessCommandLine !has "IntuneManagement" // Exclude Intune
| project Timestamp, DeviceId, DeviceName, FileName,
ProcessCommandLine, AccountName,
InitiatingProcessFileName, ReportIdMeasure the effectiveness of your detection policies by building KQL queries that track coverage, alert volume, auto-remediation rates, and policy gaps across device groups.
// ---------------------------------------------------------
// WHAT: Detection coverage dashboard - alerts by source and severity
// WHY: Measures which detection layers are generating alerts.
// Low counts from a specific DetectionSource may indicate
// policy gaps (e.g., custom rules not triggering).
// DetectionSource values: "WindowsDefenderAv", "EDR", "CustomDetection",
// "CustomerTI", "SmartScreen", "AntimalwareScanInterface".
// CriticalPercent: High % = mature detections catching real threats.
// Low % = mostly informational noise.
// ---------------------------------------------------------
AlertInfo
| where Timestamp > ago(30d)
| summarize AlertCount = count(),
UniqueAlerts = dcount(Title),
CriticalCount = countif(Severity == "High" or Severity == "Critical"),
AutoResolved = countif(ServiceSource == "Automated investigation")
by DetectionSource
| extend CriticalPercent = round(100.0 * CriticalCount / AlertCount, 1)
| sort by AlertCount desc
// ---------------------------------------------------------
// WHAT: Detection coverage by MITRE ATT&CK tactic
// WHY: Identifies which kill chain phases your detections cover.
// Gaps in specific tactics (e.g., no Persistence detections)
// indicate you need additional custom rules for those techniques.
// LOGIC: mv-expand unpacks the AttackTechniques JSON array so each
// technique gets its own row for accurate counting.
// ---------------------------------------------------------
AlertInfo
| where Timestamp > ago(30d)
| where isnotempty(AttackTechniques)
| mv-expand tactic = parse_json(AttackTechniques)
| summarize AlertCount = count(),
UniqueDevices = dcount(AlertId)
by tostring(tactic)
| sort by AlertCount desc// ---------------------------------------------------------
// WHAT: Identify devices missing key security configurations
// WHY: Devices with protection features disabled are the most
// vulnerable nodes in your fleet. This query uses TVM
// (Threat & Vulnerability Management) assessments to find gaps.
// TABLE: DeviceTvmSecureConfigurationAssessment
// ConfigurationId reference (security posture checks):
// scid-2010 = Real-time protection enabled
// scid-2011 = PUA (Potentially Unwanted App) protection enabled
// scid-2012 = Cloud-delivered protection enabled
// scid-2013 = Tamper protection enabled
// scid-91 = Network protection enabled
// scid-92 = Controlled folder access enabled
// LOGIC: IsApplicable=1 means the check applies to this device.
// IsCompliant=0 means the device FAILS the check.
// MissingCount = how many checks this device fails.
// OUTPUT: Devices sorted by most missing configs - remediate top entries first.
// ---------------------------------------------------------
DeviceTvmSecureConfigurationAssessment
| where ConfigurationId in (
"scid-2010", // Real-time protection
"scid-2011", // PUA protection
"scid-2012", // Cloud-delivered protection
"scid-2013", // Tamper protection
"scid-91", // Network protection
"scid-92" // Controlled folder access
)
| where IsApplicable == 1
| where IsCompliant == 0
| summarize MissingConfigs = make_set(ConfigurationId),
MissingCount = count()
by DeviceId, DeviceName
| sort by MissingCount desc// ---------------------------------------------------------
// WHAT: Track custom indicator (IoC) hit rates over time
// WHY: A daily trend of IoC hits shows whether your threat
// intelligence is actively protecting against current threats.
// Flat-line = IoCs may be stale and need refreshing.
// Spike = active campaign targeting your organization.
// DetectionSource "CustomerTI" = Custom Indicators you imported.
// OUTPUT: Time chart for executive reporting.
// ---------------------------------------------------------
AlertInfo
| where Timestamp > ago(30d)
| where DetectionSource == "CustomerTI"
| summarize DailyHits = count() by bin(Timestamp, 1d)
| render timechart
// ---------------------------------------------------------
// WHAT: Top triggered custom indicators by alert title
// WHY: Identifies which specific IoCs (file hashes, IPs, URLs)
// are most actively matched. High-hit indicators confirm
// your TI is relevant. Zero-hit indicators should be reviewed
// for removal to keep the indicator list manageable.
// ---------------------------------------------------------
AlertInfo
| where Timestamp > ago(30d)
| where DetectionSource == "CustomerTI"
| summarize HitCount = count(),
AffectedDevices = dcount(AlertId)
by Title, Severity
| sort by HitCount descValidate that your detection policies catch real-world attack techniques by running safe simulations on your test devices. Each test below includes the exact script to run and the expected outcome to verify.
# ---------------------------------------------------------
# WHAT: Standard MDE detection test command (safe, no actual malware)
# WHY: Validates that the NGAV detection layer is operational.
# The command simulates a download-and-execute pattern that
# MDE's behavioral engine is designed to detect.
# DETECTION: Triggers "Microsoft Defender for Endpoint test alert"
# within 15-30 minutes in the Defender portal.
# NOTE: Connects to localhost (127.0.0.1) only - completely safe.
# ---------------------------------------------------------
powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden `
$ErrorActionPreference='silentlycontinue'; `
(New-Object System.Net.WebClient).DownloadFile( `
'http://127.0.0.1/1.exe','C:\test-WDATP-test\invoice.exe'); `
Start-Process 'C:\test-WDATP-test\invoice.exe'
# Verify: An alert should appear in the portal within 15-30 minutes# ---------------------------------------------------------
# WHAT: Test network protection by accessing the SmartScreen test URL
# WHY: Validates that network protection blocks connections to
# known-malicious URLs across ALL browsers, not just Edge.
# The test URL is safe but classified as malicious by SmartScreen.
# EXPECTED (Block mode): Browser shows a block/warning page.
# EXPECTED (Audit mode): No block, but Event ID 1125 is logged.
# ---------------------------------------------------------
Start-Process "https://smartscreentestratings2.net"
# Verify block was recorded in the Defender event log
# Event ID 1125 = network protection triggered (block or audit)
Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" |
Where-Object { $_.Id -eq 1125 } |
Select-Object -First 5 TimeCreated, Message# ---------------------------------------------------------
# WHAT: Test the custom PowerShell detection rule from Step 13
# WHY: Validates that your KQL-based custom detection rule actually
# triggers when an encoded PowerShell command is executed.
# HOW: Creates a Base64-encoded 'Write-Host "Detection test"' command
# and runs it via -EncodedCommand, which matches the detection
# rule's "-EncodedCommand" pattern.
# EXPECTED: Custom detection rule fires an alert within 1-3 hours
# (based on the rule's configured frequency).
# VERIFY: Hunting > Custom detection rules > select rule > Last run results
# ---------------------------------------------------------
$command = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Write-Host "Detection test"'))
powershell.exe -EncodedCommand $command
# Verify: Your custom detection rule should trigger an alert
# Check: Hunting > Custom detection rules > select rule > Last run resultsCreate a comprehensive policy documentation artifact that records every detection policy, its configuration, target scope, and validation status. This document serves as both an operational reference and an audit artifact.
# ---------------------------------------------------------
# WHAT: Export the complete Defender configuration from a device
# WHY: Creates a comprehensive policy report for documentation,
# compliance audits, and baseline comparison across devices.
# Run on devices from each device group to verify consistency.
# OUTPUT: CSV file at C:\Temp\MDE-PolicyReport-.csv
# ---------------------------------------------------------
# Collect all relevant Defender preferences and status
$config = Get-MpPreference
$status = Get-MpComputerStatus
# Build a structured report object with key policy settings
$report = [PSCustomObject]@{
DeviceName = $env:COMPUTERNAME
RealTimeProtection = $status.RealTimeProtectionEnabled
BehaviorMonitoring = $status.BehaviorMonitorEnabled
TamperProtection = $status.IsTamperProtected
CloudProtectionLevel = $config.CloudBlockLevel # 0-6 scale
CloudExtendedTimeout = $config.CloudExtendedTimeout # seconds
MAPSReporting = $config.MAPSReporting # 0-2
SampleSubmission = $config.SubmitSamplesConsent # 0-3
NetworkProtection = $config.EnableNetworkProtection # 0=Off,1=Block,2=Audit
ControlledFolderAccess = $config.EnableControlledFolderAccess
PUAProtection = $config.PUAProtection # 0=Off,1=Block,2=Audit
AntivirusVersion = $status.AMProductVersion
SignatureVersion = $status.AntispywareSignatureVersion
LastSignatureUpdate = $status.AntivirusSignatureLastUpdated
}
# Display the report in the console
$report | Format-List
# Export to CSV for audit documentation and cross-device comparison
$report | Export-Csv -Path "C:\Temp\MDE-PolicyReport-$env:COMPUTERNAME.csv" -NoTypeInformation
Write-Host "Policy report exported to C:\Temp\MDE-PolicyReport-$env:COMPUTERNAME.csv" | Resource | Description |
|---|---|
| Configure endpoints onboarding to Microsoft Defender for Endpoint | Overview of onboarding methods for Windows, macOS, and Linux endpoints |
| Automated investigation and response in Microsoft Defender for Endpoint | Configure automated investigation levels and remediation actions |
| Role-based access control for Microsoft Defender for Endpoint | Set up RBAC with device group scoping for multi-tier SOC teams |
| EDR in block mode | Enable post-breach blocking even with third-party antivirus installed |
| Manage indicators | Create custom indicators for files, IPs, URLs, and certificates |
| Web content filtering | Block access to websites by category using web content filtering |
| Device control in Microsoft Defender for Endpoint | Manage removable media and USB device access policies |
| Protect security settings with tamper protection | Prevent unauthorized changes to Defender Antivirus security settings |
| Network protection | Block outbound connections to malicious domains and IP addresses |
| Custom detection rules | Build KQL-based detection rules for organization-specific threats |