{"id":89549,"date":"2019-06-20T09:10:35","date_gmt":"2019-06-20T16:10:35","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=89549"},"modified":"2023-05-15T23:10:35","modified_gmt":"2023-05-16T06:10:35","slug":"evolution-of-microsoft-threat-protection-june-update","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/06\/20\/evolution-of-microsoft-threat-protection-june-update\/","title":{"rendered":"The evolution of Microsoft Threat Protection, June update"},"content":{"rendered":"
Since our announcement of Microsoft Threat Protection<\/a> at Microsoft Ignite, our goal has been to execute and deliver on our promise of helping organizations protect themselves from today\u2019s sophisticated and complex threat landscape. As we close out our fiscal year, we\u2019ve continued progress on developing Microsoft Threat Protection, launching new capabilities and services. Hopefully, you\u2019ve had a chance to follow our monthly updates<\/a>.<\/p>\n As we previously<\/a> shared, Microsoft Threat Protection enables your organization to:<\/p>\n This month, we want to share new capabilities that are starting public previews.<\/p>\n Presently, efficient and effective response to identity threats is crucial, and Microsoft Threat Protection is built on the industry\u2019s most widely used and comprehensive identity security service<\/a>. As more organizations adopt hybrid environments, data is spread across multiple applications, is on-premises and in the cloud, and is accessed by multiple devices (often personal devices) and users. Most organizations no longer have a defined<\/em> network perimeter, making traditional security tools obsolete. Identity is the control plane that is consistent across all elements of the modern organization.<\/p>\n At RSA, we announced<\/a> a new unified Identity Threat Investigation experience between Azure Active Directory (Azure AD) Identity Protection, Azure Advanced Threat Protection (ATP), and Microsoft Cloud App Security<\/a>. This experience will go into public preview this month.<\/p>\n Part of the new experience is enabled through Azure AD\u2019s new integration with Azure ATP<\/a>. Also, integration between Azure AD and Microsoft Cloud App Security enables continuous monitoring of user behavior from sign-in through the entire session. Microsoft Threat Protection\u2019s identity services leverage user behavior analytics to create a dynamic investigation priority score<\/a> (Figure 1) based off signal from Azure AD, Microsoft Cloud App Security, and Azure ATP. The investigation priority is calculated by assessing security alerts, abnormal activities, and potential business and asset impact related to each user. This score can help Security Operations (SecOps) teams focus and respond to the top user threats in the organization.<\/p>\n <\/a><\/p>\n Figure 1. The investigation priority view.<\/em><\/p>\n To learn more, read Investigating identity threats in hybrid cloud environments<\/a>.<\/p>\n Every month, Microsoft Threat Protection detects over 5 billion endpoint threats through its Microsoft Defender ATP service. Customers have long asked us to extend our industry-leading endpoint security beyond the Windows OS. This was a major driving force for us to deliver endpoint security natively for macOS in limited preview earlier this year. We\u2019re excited to announce<\/a> that Microsoft Defender ATP for macOS is in public preview.<\/p>\n Microsoft Threat Protection\u00a0customers who have turned on the Microsoft Defender ATP preview features<\/a>\u00a0can access Microsoft Defender ATP for Mac via the\u00a0onboarding section<\/a>\u00a0in the Microsoft Defender Security Center. For more information and resources, including system requirements, prerequisites, and a list of improvements and new features, check out the\u00a0Microsoft Defender ATP for Mac documentation<\/a>.<\/p>\n To further enhance your endpoint security, “live response,” our new incident response action for SecOps teams, is currently in public preview.<\/a> Today, your\u00a0employees often\u00a0work beyond the corporate network boundary, whether from home or while traveling. The risk for compromise\u00a0is potentially\u00a0higher when a user is remote. Imagine the executive who\u00a0connects their laptop to hotel Wi-Fi\u00a0and\u00a0is compromised. With current endpoint security services, SecOps would\u00a0need to wait until the\u00a0executive got\u00a0back to the office, leaving a high-value laptop exposed.\u00a0With our new live response, SecOps teams gain instant access to a compromised machine regardless of location,\u00a0as well as the ability to gather any required forensic information.<\/p>\n This powerful\u00a0feature allows you to:<\/p>\n To learn\u00a0more,\u00a0try\u00a0the\u00a0live response\u00a0DIY<\/a>\u00a0or read Investigate entities on machines using live response<\/a>.<\/p>\n <\/a><\/p>\n Figure 2. Run remediation commands.<\/em><\/p>\n Take a moment to\u00a0learn more about Microsoft Threat Protection<\/a>, read our previous\u00a0monthly updates<\/a>, and visit\u00a0the Microsoft Threat Protection webpage<\/a>.\u00a0Organizations, like Telit<\/a>, have already transitioned to Microsoft Threat Protection and our partners<\/a> are also leveraging its powerful capabilities.<\/p>\n Begin a trial of Microsoft Threat Protection services, which also includes our newly launched SIEM, Azure Sentinel, to experience the benefits of the most comprehensive, integrated, and secure threat protection solution for the modern workplace.<\/p>\n Learn about new Microsoft Threat Protection capabilities now in public preview.<\/p>\n","protected":false},"author":96,"featured_media":88399,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3662],"topic":[3672,3685],"products":[3690,3694,3702,3703,3726],"threat-intelligence":[],"tags":[],"coauthors":[1916],"class_list":["post-89549","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-news","topic-endpoint-security","topic-siem-and-xdr","products-microsoft-defender","products-microsoft-defender-for-endpoint","products-microsoft-entra","products-microsoft-entra-id","products-microsoft-sentinel"],"yoast_head":"\n\n
Efficient remediation and response for identity threats<\/h3>\n
Game-changing capabilities for endpoint security<\/h3>\n
\n
Experience the evolution of Microsoft Threat Protection<\/h3>\n
\n