🔥Microsoft Defender for Endpoint now offers the ability to discover internet-facing devices!
🔍 Threat actors are always on the lookout for exposed devices, which can serve as easy entry points to an organization's environment. Mapping your organization's external attack surface is crucial for security posture management.
To improve visibility, Microsoft Defender for Endpoint will automatically map, and flag onboarded devices that are exposed to the internet in the Microsoft 365 Defender portal. This provides security teams with more context and deeper insights into device exploitability.
📌New capabilities include:
🔹Mapping internet-facing devices using existing Microsoft Defender for Endpoint telemetries and RiskIQ.
🔹A standardized approach to gather insights with precision and less manual effort.
📌Integration with RiskIQ:
🔹Catalogs services, applications, and devices exposed on the IPv4 Internet.
🔹Works with Defender for Endpoint's network traffic parsing capability to provide concrete evidence of network exposures.
📌Relying on Microsoft Defender for Endpoint Signals:
🔹Identifies internet-facing devices using captured device network connections.
🔹Determines subnets for machines protected by Defender for Endpoint to help identify whether a connection is internal or external.
Want to learn more?
MS Docs: Discovering Internet-facing Devices (microsoft.com)