Advanced Configuration

Defender for Endpoint allows users to define custom detection rules using Kusto queries. These custom queries function like advanced hunting queries, but they evaluate anywhere from once per hour to once per twenty-four hours. Additionally, custom detections enable you to specify the metadata associated with a detection.

To learn how to create custom detection rules, see Create and manage custom detections rules.

Note: Only users with Security Administrator or Security Operator permissions can create custom detection rules.

Attack surface reduction rules are rules intended to reduce risk by inhibiting certain malicious behaviors associated with attacks. However, because some rules prohibit the behaviors of legitimate applications, it's important to assess the risk to your environment before deciding which rules to apply. You can use Defender for Endpoint's audit mode to evaluate the impact of a rule on the objects in your environment.

1. Log in to https://endpoint.microsoft.com/.

2. Click Endpoint security, and then select Attack surface reduction.

3. Click Create Policy.

4. Under Platform, select Windows 10 and later.

5. Under Profile, select Attack surface reduction rules.

6. Click Create, enter a name and description, then click Next.

7. Under Attack Surface Reduction Rules, set all rules to Audit mode.

8. Step through the rest of the setup wizard, and assign the appropriate device scope.

Defender for Endpoint has its own unique security baseline that can be enabled via configuration management, or from endpoint management policies. The baseline contains settings for many components, including the following:

• Attack surface reduction

• Bitlocker

• Device guard

• Device installation

• DMA guard

• Firewall

• Microsoft Defender

• Smart screen

Security baselines are one of the strongest ways to enforce policy across an organization.

Caution: Security baselines edit multiple security policies at once, and can impact performance and accessibility. Use extreme caution when reviewing and implementing security baselines.

1. Log in to https://endpoint.microsoft.com/.

2. Click Endpoint security, and then select Security baselines.

3. Click Create profile.

4. Enter a name and description, and then click Next.

5. Carefully review the configuration settings for all categories.

6. Assign the policy to the correct scope, group, or users.

7. Click Create.