Windows Defender Advanced Threat Protection

Windows Defender Advanced Threat Protection (ATP) is a security service that enables enterprise customers to detect, investigate, and respond to advanced threats on their networks. This chapter provides information about the service, how to configure it, and then maintain and use it for operations. This introduction will explain the prerequisites to enabling this service and give an overview of the key components. The chapter is split into the following logical sections to provide relevant information:

• Plan: Understand the requirements and plan for the changes required to deploy and adopt this solution within your environment
• Deploy: Configuration details to enable the ATP portal, onboard endpoints, and ensure correct network connectivity
• Detect: Detection and investigation steps that ensure you can quickly identify the scope and targets...

Prerequisites

Windows Defender ATP requires one of the following Microsoft Volume Licensing solutions:

• Windows 10 Enterprise E5
• Windows 10 Education E5
• Secure Productive Enterprise E5, which includes Windows 10 Enterprise E5

When you run the onboarding wizard for the first time, you must choose where your Windows Defender ATP-related information is stored: either in a European or United States data center. You cannot change your data storage location after the first setup.

Windows Defender ATP runs on version 1706 and preceding Windows editions:

• Windows 10 Enterprise
• Windows 10 Education
• Windows 10 Pro
• Windows 10 Pro Education

Each endpoint must have an internet connection, which may utilize up to 5 MB of bandwidth daily to communicate with the Windows Defender ATP cloud service and report cyber data.

The Windows Defender signature update (or an alternative and compatible...

Windows Defender

Windows Defender is antivirus software that is built-in to the Windows OS and protects your systems against viruses, malware, spyware, and network threats. It is a Windows service that works with other Microsoft security and maintenance services such as Windows Firewall and Microsoft SmartScreen. All of these services are enabled by default and start at system startup. Windows Update will take care of updating itself automatically, if configured to do so. Updating Windows Defender does not require system restart.

Some key features of Windows Defender in Windows 10 include the following:

• Microsoft Active Protection Service (MAPS): This uses the metadata of a file to analyze for potential malware, which if found can result in a new virus signature file being created to protect other devices
• Network Inspection System: This helps guard against intrusion attempts...

Plan - environment analysis

This section provides a list of the key considerations and recommendations when deploying the Windows Defender ATP service.

Client types:

• Endpoints should be running Windows 10 version 1706 (Creators Update)
• Confirm that the standard build is configured appropriately to ensure the service can run without impacting the performance of the device
• Run a test to ensure all sensor information is collected correctly (refer to details about collecting an investigation package in the Take responsive actions section later in this chapter)
• Sufficient licenses should be owned and assigned to users and devices
• Internet connectivity should be enabled to ensure communication between endpoints and the ATP service, and sufficient bandwidth available for the number of clients that will be reporting daily
• Consider which clients are at high risk and may require a higher...

Deploy - service activation

This section will explain the steps required to enable and fully deploy this solution to protect users and devices across your organization. The following activities will be explained:

• Sign up and activate the Windows Defender ATP service
• Onboard endpoints
• Configure sensor data
• Other configurations

Sign up and activate Windows Defender ATP

The service is dependent on your Azure tenant being activated and configured. You will then need to ensure the appropriate licenses have been acquired and associated with your subscription.

Administrator permissions: The administrator will need to be a member of the security administrator role to enable the service, run through the initial configuration wizard...

Onboard endpoints

This is achieved by deploying a configuration package to each endpoint. Currently, this works for Windows 10, version 1706 (Creators Update). Windows Server 2016 and Windows Server 2012 R2 will be supported in the future.

There are several methods and deployment tools that can be used to deploy the configuration package to each endpoint, depending on what works best for your organization size and complexity:

• If your endpoints are joined to an AD domain, you can use Group Policy to deploy the script
• If you have deployed SCCM, this can be used to deploy it to each managed device
• Devices managed by MDM, such as Microsoft Intune
• A script can be run manually on each individual machine regardless of how it is managed, as long as it has internet connectivity to the ATP service

The configuration package is unique to your tenant, and is available for download from the...

Detect - using the ATP portal

The first thing you will see when you login to the ATP portal is the Dashboard view:

Dashboard navigation overview:

• Left-side navigation pane (1)
• Main portal window for displaying dashboard tiles and details (2)
• Search, Feedback, Settings, and Help and Support (3)

The Dashboard displays a snapshot of the following components:

• The latest active alerts on your network, with the most important highlighted at the top
• Daily machines reporting to show how many machines are actively reporting each day
• Machines at risk will show those endpoints with the highest risks
• The users at risk report provides quick identification of those users
• Machines with active malware alerts
• Sensor and service health

Alerts queue

...

Protect Post-breach response

This section will cover the types of threats that are addressed by Windows Defender ATP, such as ransomware and credential theft, and what responses you can take when a suspect machine, file, or process is found - to ensure you collect the relevant information for a through investigation and clean up.

Types of threats

The Windows Defender ATP service can detect a wide range of threats. Each one is discussed in the following sections, and more may be added in future as the threat landscape changes. Use this information to gain awareness of the various types of threats, and keep up to date with changes by reviewing the Microsoft Security Intelligence Report, which is released via the following...

Summary

In this chapter, we covered the advanced capabilities that are available when Windows 10 Enterprise is integrated with the Windows Defender ATP service. We now have the ability to gain instant visibility into critical actions of every Windows 10 client that we manage, regardless of where it is in the world. Being able to draw upon the knowledge of global hunter teams and cyber security experts, we can quickly detect, investigate, and respond to advanced threats that standalone software cannot defend from.

This technology is constantly evolving to bring new techniques and process directly to you. Deploy it in your environment, get comfortable with the current controls and capabilities, and stay informed of the changes to ensure you know how to defend and recover from a breach.

In the next chapter we will cover some of the advanced configurations you can make with Windows...