{"id":27394,"date":"2019-06-20T16:10:35","date_gmt":"2019-06-20T16:10:35","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=89549"},"modified":"2019-06-20T16:10:35","modified_gmt":"2019-06-20T16:10:35","slug":"the-evolution-of-microsoft-threat-protection-june-update","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/the-evolution-of-microsoft-threat-protection-june-update\/","title":{"rendered":"The evolution of Microsoft Threat Protection, June update"},"content":{"rendered":"

Since our announcement of Microsoft Threat Protection<\/a> at Microsoft Ignite, our goal has been to execute and deliver on our promise of helping organizations protect themselves from today\u2019s sophisticated and complex threat landscape. As we close out our fiscal year, we\u2019ve continued progress on developing Microsoft Threat Protection, launching new capabilities and services. Hopefully, you\u2019ve had a chance to follow our monthly updates<\/a>.<\/p>\n

As we previously<\/a> shared, Microsoft Threat Protection enables your organization to:<\/p>\n

This month, we want to share new capabilities that are starting public previews.<\/p>\n

Efficient remediation and response for identity threats<\/h3>\n

Presently, efficient and effective response to identity threats is crucial, and Microsoft Threat Protection is built on the industry\u2019s most widely used and comprehensive identity security service<\/a>. As more organizations adopt hybrid environments, data is spread across multiple applications, is on-premises and in the cloud, and is accessed by multiple devices (often personal devices) and users. Most organizations no longer have a defined<\/em> network perimeter, making traditional security tools obsolete. Identity is the control plane that is consistent across all elements of the modern organization.<\/p>\n

At RSA, we announced<\/a> a new unified Identity Threat Investigation experience between Azure Active Directory (Azure AD) Identity Protection, Azure Advanced Threat Protection (ATP), and Microsoft Cloud App Security<\/a>. This experience will go into public preview this month.<\/p>\n

Part of the new experience is enabled through Azure AD\u2019s new integration with Azure ATP<\/a>. Also, integration between Azure AD and Microsoft Cloud App Security enables continuous monitoring of user behavior from sign-in through the entire session. Microsoft Threat Protection\u2019s identity services leverage user behavior analytics to create a dynamic investigation priority score<\/a> (Figure 1) based off signal from Azure AD, Microsoft Cloud App Security, and Azure ATP. The investigation priority is calculated by assessing security alerts, abnormal activities, and potential business and asset impact related to each user. This score can help Security Operations (SecOps) teams focus and respond to the top user threats in the organization.<\/p>\n

<\/a><\/p>\n

Figure 1. The investigation priority view.<\/em><\/p>\n

To learn more, read Investigating identity threats in hybrid cloud environments<\/a>.<\/p>\n

Game-changing capabilities for endpoint security<\/h3>\n

Every month, Microsoft Threat Protection detects over 5 billion endpoint threats through its Microsoft Defender ATP service. Customers have long asked us to extend our industry-leading endpoint security beyond the Windows OS. This was a major driving force for us to deliver endpoint security natively for macOS in limited preview earlier this year. We\u2019re excited to announce<\/a> that Microsoft Defender ATP for macOS is in public preview.<\/p>\n

Microsoft Threat Protection customers who have turned on the Microsoft Defender ATP preview features<\/a> can access Microsoft Defender ATP for Mac via the onboarding section<\/a> in the Microsoft Defender Security Center. For more information and resources, including system requirements, prerequisites, and a list of improvements and new features, check out the Microsoft Defender ATP for Mac documentation<\/a>.<\/p>\n

To further enhance your endpoint security, \u201clive response,\u201d our new incident response action for SecOps teams, is currently in public preview.<\/a> Today, your employees often work beyond the corporate network boundary, whether from home or while traveling. The risk for compromise is potentially higher when a user is remote. Imagine the executive who connects their laptop to hotel Wi-Fi and is compromised. With current endpoint security services, SecOps would need to wait until the executive got back to the office, leaving a high-value laptop exposed. With our new live response, SecOps teams gain instant access to a compromised machine regardless of location, as well as the ability to gather any required forensic information.<\/p>\n

This powerful feature allows you to:<\/p>\n