Guest blog courtesy of LimaCharlie.
Did you see the LinkedIn post from Maxime Lamothe-Brassard about receiving MS Defender alerts faster than they come through Microsoft’s native ecosystem? Too often gems of information like this are lost in a sea of social media noise.
This post is worth revisiting because it can be a game changer for security service providers.
Consider the business implications of this finding. Roughly 70% of organizations workstations run Windows OS, and most of them ship with Defender enabled as their EDR. In a competitive environment where differentiation is key, faster Defender detections can make your business stand out.
What’s the secret?
Maxime achieved this performance boost by integrating Defender into LimaCharlie’s SecOps Cloud Platform (SCP). This allowed him to overcome the friction that exists in Microsoft’s native infrastructure. As he explained in a larger blog post:
“First, while Microsoft may be a single company, they’re not immune to the issue of siloed product lines and development teams. Microsoft today is essentially a cloud provider with an operating system, that also owns a suite of office software, that also has an endpoint solution, etc. Even though everything is under one umbrella, there will still be problems stitching all of that together and making everything work well.
Second, and I think this is what impacts us the most as cybersecurity practitioners, is the fact that the vast majority of Microsoft products are not built for us. We’re simply not the intended audience. The audience for MS Office is business users. The audience for Microsoft’s cloud computing offerings? IT groups and developers. In other words, out of all of the product lines in the Microsoft family, really only one of them is aimed at (and optimized for) SecOps teams.”
In short: MSSPs and service providers are not Microsoft’s focus. Augmenting your existing Defender deployment with a platform built for security professionals is the key to unlocking its full value.
Consolidating on a SecOps platform
As the name suggests, the SecOps Cloud Platform provides a cloud-based foundation for integrating security tooling and creating customized solutions. Unlike Microsoft’s broad consumer-oriented portfolio, the SCP is designed by security engineers, for security engineers.
MSSPs can integrate Defender into the SCP with a single mouse click (that enables the endpoint protection extension). This integration works alongside your existing Microsoft infrastructure - you’re not replacing Defender, you’re supercharging it.
Once integrated, you can:
- Receive MS Defender alerts in seconds vs. minutes/hours
- Check the status of Defender across endpoints and tenants
- Initiate targeted AV scans
- Automate Defender performance and management
- Integrate Defender actions and information into other security workflows
The SCP returns Defender detections as soon as they appear on an affected system rather than taking hours to receive them through Microsoft’s siloed infrastructure. It also makes it easy to incorporate Defender with the rest of your security workflows via simple API integration.
There are compounding benefits to managing multiple organizations on the SecOps Cloud Platform. Specifically, your security operations gain cloud scalability while being hosted on a natively multi-tenant environment. Not only can you receive Defender insights faster, but you can scale your deployments and easily manage instances across multiple environments. Simply put, your security operations will be faster and more flexible than competitors who are using alternative methods.
Ready to see this in action? Join our Microsoft Defender Workshop
Want to see how MSSPs are achieving faster Defender detections and streamlining their security operations? Join our upcoming workshop where you’ll get hands-on with our Defender integration, see real-world performance improvements, and learn ways to enhance your existing Microsoft security stack without disrupting your current operations.
In this technical hands-on workshop, you will:
- Integrate Defender into the SecOps Cloud Platform in minutes
- Achieve wirespeed Defender alert response times
- Scale Defender management across multiple tenants
- Automate routine Defender tasks and workflows
October 15 @ 10am PT/ 1pm ET
This is a live workshop and will not be recorded.
Register now: https://limacharlie.wistia.com/live/events/su08f1kjsa?utm_source=msspalert
Can’t make it? Learn more about how MSSPs benefit from the SecOps Cloud Platform at limacharlie.io.
