Microsoft Defender for Endpoint Series-Part 7: Threat and Vulnerability Management Module

Threat and Vulnerability Management -a component of Microsoft Defender for Endpoint

Do you often find forums discussing Microsoft Defender for Endpoint and its features, but still have questions in mind?

🚀A one-stop solution for all your questions- We have started a Microsoft Defender for Endpoint Series, where we want to cover topics on a deeper level and discover the possibilities with all kinds of threats and endpoints!

Fig i) Learn Microsoft Defender for Endpoint with #Salona aka #Intunesiastic

Microsoft’s Threat and Vulnerability Management module is a component of Microsoft Defender for Endpoint. It effectively identifies, assesses, and remediates endpoint weaknesses. This process is pivotal in running a healthy security program and reducing organizational risk.

Threat and Vulnerability Management is the first solution in the industry to bridge the gap between security administration and IT administration during the remediation process. It enables organizations to create a security task or ticket by integrating with Microsoft Intune. It serves as an infrastructure for reducing organizational exposure, hardening endpoint surface area, and increasing organizational resilience. It uses sensors to discover vulnerabilities and misconfigurations in real time. This discovery is completed without the need of agents or periodic scans. Threat and Vulnerability Management prioritizes vulnerabilities based on:

the threat landscape
detections in your organization
sensitive information on vulnerable devices
business context

As we have already enabled in Part 3: Integration of Microsoft Intune with Microsoft Defender for Endpoint, we shall automatically get the threat and vulnerability management findings without the need for more agents.

Real-time discovery

Threat and Vulnerability Management provides:

Real-time device inventory. Devices onboarded to Microsoft Defender for Endpoint automatically report and push vulnerability and security configuration data to the dashboard.
Visibility into software and vulnerabilities. Optics into the organization’s software inventory, and software changes like installations, uninstalls, and patches. Newly discovered vulnerabilities are reported with actionable mitigation recommendations for 1st and 3rd party applications.
Application runtime context. Visibility on application usage patterns for better prioritization and decision-making.
Configuration posture. Visibility into organizational security configuration or misconfigurations. Issues are reported in the dashboard with actionable security recommendations.

Intelligence-driven prioritization

It helps customers prioritize and focus on the weaknesses that pose the most urgent and highest risk to an organization. It fuses security recommendations with dynamic threat and business context:

Exposing emerging attacks in the wild. Dynamically aligns the prioritization of security recommendations. Threat and vulnerability management focuses on vulnerabilities currently being exploited in the wild and emerging threats that pose the highest risk.
Pinpointing active breaches. Correlates threat and vulnerability management and EDR insights to prioritize vulnerabilities being exploited in an active breach within the organization.
Protecting high-value assets. Identify the exposed devices with business-critical applications, confidential data, or high-value users.

Seamless remediation

The Threat and Vulnerability Management module enables security administrators and IT administrators to collaborate seamlessly to remediate issues.

Remediation requests sent to IT. Create a remediation task in Microsoft Intune from a specific security recommendation. This capability is in the process of being expanded to other IT security management platforms.
Alternate mitigations. Gain insights on other mitigations, such as configuration changes that can reduce risk associated with software vulnerabilities.
Real-time remediation status. Real-time monitoring of the status and progress of remediation activities across the organization.

Bridging the Traditonal workflow gaps

In the traditonal methods, a separation of duties causes long delays from detecting vulnerabilities until remediation. The following traditional timeline is a common scenario in many organizations:

Security Operations teams analyze breach incidents and remediate attacks.
Security Administration teams discover and prioritize risks and ensure the company meets compliance requirements.
IT administration remediates the risk with configuration changes, updates, and patches.

The Threat and Vulnerability Management module bridges the gap between all of these above roles. It helps organizations discover vulnerabilities and misconfiguration in real-time. There are no periodic scans.

With this component from Microsoft Defender for Endpoint organizations get a holistic, real-time approach to mature their vulnerability management program. It does so by providing the following automated, end-to-end vulnerability remediation process:

When Security Operations analyzes alerts, they see relevant context about vulnerabilities and misconfiguration for the impacted machines.
At the same time, Security Administration can watch the exposure score go up when vulnerabilities are discovered.
With the push of a button, a Security Administrator can submit a remediation request.
This request goes directly to the IT Administrator. It includes all the context and insights about the required mitigation.
The IT Administrator approves the request and prepares to push the update to all exposed machines.
While IT is updating, Microsoft’s security teams can keep track of the updates progress as business gets back to normal.

Threat and Vulnerability Management- Dashboard insights

It provides both – the security administrators and the security operations teams with unique value, including:

Real-time endpoint detection and response (EDR) insights correlated with endpoint vulnerabilities.
Invaluable device vulnerability context during incident investigations.
Built-in remediation processes through Microsoft Intune and Microsoft Endpoint Configuration Manager.

An organization can use the Threat and Vulnerability Management capability in the Microsoft Defender portal to:

View the following security data:
- its exposure score
- its Microsoft Secure Score for Devices
- top security recommendations
- software vulnerability
- remediation activities
- exposed devices
Correlate EDR insights with endpoint vulnerabilities and process them.
Select remediation options to triage and track the remediation tasks.
Select exception options and track active exceptions.

Note: Devices must be active in the last 30 days to be factored in on the data that reflects an organization’s threat and vulnerability management exposure score and Microsoft Secure Score for Devices.

So, I hope that today, I was able to simplify your understanding on Microsoft’s Threat and Vulnerability Management module of Microsoft Defender for Endpoint .

Moreover, would you want to go to the other topics and revise? Well, here you goooo!

My Motto is- ‘The Fastest Way To Learn & Retain Any Skill Is -To Teach It !’
Lastly, we recommend to Stay tuned with us to progress on Microsoft Defender for Endpoint Chronicles. This is just the beginning.🌟

Author: Salona Sahni Kapoor aka Intunesiastic
cubic solutions GmbH

