Matthew Zorich

Become an MDI expert and transform your IT security with advanced identity protection strategies to safeguard against evolving cyber threats Key Features Optimize configurations for peak security performance by tailoring detection thresholds Leverage real-world insights and case studies to improve threat detection and response strategies Establish a strong ITDR defense with Microsoft Defender for Identity Purchase of the print or Kindle book includes a free PDF eBook Book DescriptionWritten by a recognized cybersecurity expert, Microsoft Defender for Identity in Depth not only lays the groundwork for deploying and managing MDI, but also takes your knowledge to expert levels, enabling you to strengthen your organization against the most advanced cyber threats. You’ll familiarize yourself with the essentials of MDI, from seamless setup to leveraging PowerShell for automation, setting the stage for exploring advanced integrations and capabilities. Through practical, real-world examples, you’ll learn how to extend MDI’s reach by using APIs and conducting proactive threat hunting with KQL to turn insights into actions. The book gradually shifts focus to operational excellence, helping you develop expertise in investigating alerts, optimizing action accounts, and troubleshooting, which will empower you to master the building and maintenance of a robust ITDR framework and strengthen your security posture. By the end of this book, you’ll be able to harness the full potential of MDI’s functionalities, positioning you as a key player in your organization’s cybersecurity defenses. What you will learn Ensure a secure and efficient MDI setup for peak defense capabilities Unlock automation with PowerShell scripting magic Seamlessly blend MDI with AD CS, AD FS, and Entra Connect Expand MDI's reach and impact through APIs Pioneer advanced threat hunting with KQL expertise in Defender XDR Craft expert, strategic responses to security alerts Optimize action accounts for maximum agility Establish a robust and rigid ITDR framework Who this book is forIf you’re an IT or security professional looking to enhance your cybersecurity skills, especially in identity protection and threat management with Microsoft Defender for Identity (MDI), then this book is for you. It's perfect for system administrators, cybersecurity analysts, and cloud engineers who want to strengthen their expertise in MDI. A basic understanding of cybersecurity principles, as well as familiarity with Microsoft environments and Active Directory are recommended prerequisites for maximizing your learning experience.

Turn the avalanche of raw data from Azure Data Explorer, Azure Monitor, Microsoft Sentinel, and other Microsoft data platforms into actionable intelligence with KQL (Kusto Query Language). Experts in information security and analysis guide you through what it takes to automate your approach to risk assessment and remediation, speeding up detection time while reducing manual work using KQL. This accessible and practical guide—designed for a broad range of people with varying experience in KQL—will quickly make KQL second nature for information security. Solve real problems with Kusto Query Language— and build your competitive advantage: Learn the fundamentals of KQL—what it is and where it is usedExamine the anatomy of a KQL queryUnderstand why data summation and aggregation is importantSee examples of data summation, including count, countif, and dcountLearn the benefits of moving from raw data ingestion to a more automated approach for security operationsUnlock how to write efficient and effective queriesWork with advanced KQL operators, advanced data strings, and multivalued stringsExplore KQL for day-to-day admin tasks, performance, and troubleshootingUse KQL across Azure, including app services and function appsDelve into defending and threat hunting using KQLRecognize indicators of compromise and anomaly detectionLearn to access and contribute to hunting queries via GitHub and workbooks via Microsoft Entra ID