Microsoft Defender for Endpoint – Basics

What Will You Learn?

• Deploy and configure Microsoft Defender for Endpoint across Windows, macOS, and Linux
• Detect, investigate, and respond to real threats using MDE alerts, incidents, and advanced hunting (KQL)
• Apply endpoint protection features such as AV, EDR, ASR rules, firewall, and device control
• Use Threat & Vulnerability Management (TVM) to identify, prioritize, and remediate risks
• Perform incident response actions like device isolation, live response, and automated remediation
• Analyze threat intelligence, attack timelines, and MITRE ATT&CK mappings
• Manage cross-platform security, onboarding methods, and policy configurations
• Understand Defender architecture, telemetry flow, and SOC workflows

Requirements

• Basic understanding of Windows, Linux, or macOS administration
• Familiarity with cybersecurity fundamentals (malware, threats, logs, SIEM concepts)
• Ability to navigate Microsoft 365 or Azure portals (helpful but not mandatory)
• Optional: Access to a test tenant or lab environment for hands-on validation

Audience

• SOC Analysts (L1/L2/L3)
• Cybersecurity Engineers
• Endpoint Security Engineers
• Incident Responders
• Cloud & Infrastructure Security Professionals
• IT Administrators transitioning to security roles