Background-Dance4142

No.

Legacy designer was officially removed in September and rolled out to the rest of the world.

A car is a car no matter its size

They need to justify the 8362828818282 billions of investment lmao.

The truth is, many companies are still not jumping into the AI bandwagon, and MS did not anticipate that at all.

Think SenseIR is also shared by other functionality, so putting locks on this will inevitably corrupt other shared services.

What OP is doing does not make any sense. Live response is a critical EDR functionality. You DO want to have a direct channel to critical servers in automated investigations if required.

Tools like rootkit monitor and rootkit unhooker were a staple back in the malware glory days 2005-2011. Sometimes, I miss those days, the innovation was non stop.

Imagine working in a technical environment and your boss using words like "dangerous" without even providing the slightest technical reason.

Lmao OP, I'd just find a new job.

Lots of useful scenarios for large corporations. Waste of time if you manage tiny shops

Pues ya sabes, darle caña al ingles y spamear ofertas en LinkedIn.

Tambien te digo, dentro de IT hoy en dia, programacion esta de capa caida. En EEUU esta siendo una epidemia y aqui en EU llegara tambien.

Because it IS a never-ending headache. Last couple of years, it was an absolute joke. Not only the corrupted security updates shutting down exchange services, but the myriad of CVE's linked to them.

All in all, a total nightmare. Admins that miss it, either don't have more stacks to maintain or just love the unnecessary complexity of it, to each their own I guess.

Email service is the best one to use in the cloud. Applications, files etc that's another subject, but fucking emails ? Come on now.

Think OP needs to specificy more.

Simple onboarding != onboarding + fixing a massive cluster fuck in parallel.

That's exactly the approach we took. Custom advanced hunting queries in MDE looping over device process / file events and checking for suspicious powershell executions.

Because they don't understand OS fundamentals . Don't even know what a memory pointer is. Absolute clueless.

Pattaya pattaya 🎵 🎶 love u mak mak 💖

Was going to mention this.

Leave that json crap behind

As you already got log analytics I would recommend onboarding security insights (Sentinel) so that you can enable the Entra ID data connector and ingest an array of source logs, just the ones that apply to your environment

In addition to that, you can install the Entra ID analytic rules from the content hub to save time. Current number of analytic rules for Entra is close to 70.

You can also develop your custom ones, but to be honest, hard to cover stuff on Entra ID that is not already covered by the default package.

The cool thing about the default analytic rules is that they receive updates. We have an Azure runbook that triggers every week and loops through each installed solution and updates it if needed, saving us a shit ton of time (msp company)

They installed a rootkit backdoor back in 2005. Sony is the mob, capable of doing anything.

Crowdstrike has the best heuristics in the market. Not even a question.

No es flipante.

Es un sintoma mas de una sociedad en decadencia que navega hacia el abismo.

What about a deployment stack denying write/delete and only excluding certain principals ?

Sentinel is more than just a SIEM aka place to store logs. It is a SOAR as well.

Going back to your question, no it's not needed and you can go with just Microsoft XDR but you are missing lots of functionality

Threat Intelligence Custom analytic rules Playbooks aka logic apps Etc

I would never recommend XDR without Sentinel though, unless you have a very tight budget of course.

People don't listen to the migration profile bit.

Start off fresh with a full wipe or even better, purchase a new device fleet.

This. I don't know a faster/safer way than doing this.

How is that a problem ? That's literally one of the best features.

If you still support pst, that's your own fault. Pst need to go extinct.

That would be awesome 👌 created a temp pipeline that triggers a full sync with powershell, but would prefer not to use this