Microsoft Windows Defender Review

A security implementation that supplies proactive issue resolution with cloud analytics and APT


What is our primary use case?

Our primary use for the solution is threat detection and response.

How has it helped my organization?

It's basically for security implementation, response planning capabilities and other security functions. Obviously, auditing, HR, requirements, legals, auditing, banking, and financial services all require a lot of the data that are generated and reported out of the platform.

What is most valuable?

The features that are most valuable for us are cloud analytics from the APT (Advanced Threat Protection) engine or quarantine, deletion, and removal. Basically, they work by web engine. Simply, it is proactive in resolving potential issues.

What needs improvement?

There are certain features that do have room for improvement. I think with the analytics engine they're looking at it from the desktop and the server perspective. I think the desktop engine should also include the script analytics — what executed, what's the power shelf or UI commands, or some form of Splunk regex. I know we don't have that functionality with a run-time analytics platform, but it's a JS (JavaScript) based one. So it would be good if they had a regex to JS converter.

The biggest problem is they need to take things out of preview. I know that they're developing on the platform service with the analytics engine, but so many services still rate it as a preview after 12 to 18 months, which is stopping adoption with businesses knowing that that solution could be filled and redirected at any time. So that delay is limiting technology to be able to be updated because they don't have to release all production support.

For how long have I used the solution?

I've been using it for about eight-and-a-half years, if you add the early adoption projects.

What do I think about the scalability of the solution?

In the last 12 months, we've moved up to the Gartner Magic Quadrant report as a leading form of threat analysis. Obviously, the more clients that migrate to Cloud Services the more analytics platforms are picking it up. There are auto-resolutions and it's getting more cross-correlations between tendency. So we're getting a lot more APT (Applied Predictive Technologies) and IOC (Indicators of Compromise) data through which you can get a better response, better response times, automatic remediation tasks, reduce the amount of the alerts and false positives — that sort of thing. It's all really useful. It's scaling out on its own.

How are customer service and technical support?

We get direct support. They're literally across the road from us. We've got multiple Microsoft engineers assigned to our contract as well, so we deal directly with their engineering teams.

How was the initial setup?

The setup was simple and straightforward.

Here we SCOM (System Center Operations Manager) SCCM (System Center Configuration Manager) deployment for pushing out the agent's, done the deployment for the AIP (Azure Information Protection) scanners and load that unified data locally.

What about the implementation team?

We consulted with Microsoft, but we're a full IT workhouse so we have qualified engineers that were coming off a three-year capability program to deliver all of those services.

As far as the amount of staff we use to support the solution, we have a lot of managed providers and different international SOC (Security Operations Center) teams and different agencies that manage a lot of the services. I would say that globally we would have probably about close to a hundred engineers working on the solutions full-time with cloud app development and Kubernetis and things like that.

Which other solutions did I evaluate?

We compared extensively between multiple services, everything from Azure, cloud service providers, identity providers, platform SaaS providers — we did all that before we sort of consolidated on certain technologies in different areas.

We're utilizing a lot of the services. There will be some future state planning goals, but we're taking a risk-averse assessment on the product. We're more controlled about how things like our customer member data protections, cryptography and those types of things are working. So we're doing still doing a little bit of assessment. I know it's got the ASD clearance rating and certain services, but that's based off the tenancy agreements.

What other advice do I have?

I'd say the product rates about an eight out of ten as it currently stands.

You have to implement the product — there's no choice. You can't use the exchange online protection or the advanced analytics or obscure identity IP protection without the APT being installed on the endpoint. Otherwise you're not getting into threat intelligence or the actions. You're not going to get the full response plan or activities that occurred. You cannot deploy without APT being installed on the desktops and have a full, defined solution for unified labeling. That has to be deployed and tested for unstructured data for at least six months with the AIP (Azure Information Protection) scan that's deployed with APT.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
Add a Comment
Guest
Sign Up with Email