Windows Defender ATPs Advanced Hunting: Using Flexible Queries to Hunt Across Your Endpoints

  • Webcast Aired Friday, 27 Jul 2018 1:00PM EDT (27 Jul 2018 17:00 UTC)
  • Speakers: Matt Bromiley, Jonathan Bar Or

Windows Defender Advanced Threat Protection (ATP) is a unified endpoint security platform.

Often times SecOps teams would like to perform proactive hunting or perform a deep-dive on alerts, and with Windows Defender ATP they can leverage raw events in order to perform these tasks efficiently.

This Webcast will share how Windows Defender ATP exposes raw events and more importantly - how to query these events efficiently. Learn how to query terabytes of data in matter of seconds to help analysts determine threats and alerts on your network.

Attendees will learn:

* Efficiently hunting for big data using Kusto Query Language

* Dissect and interpret interesting information from attacks

* Perform a live deep-dive on a file-less malware attack and extract important attribution