Visão Geral

Este curso apresenta o Microsoft Defender no contexto da proteção de endpoints Windows. Aborda mecanismos de prevenção, detecção, resposta, políticas de segurança, proteção contra malware, Attack Surface Reduction, monitoramento e integração com recursos corporativos de segurança.

Objetivo

Após realizar este curso, você será capaz de:

• Configurar recursos do Microsoft Defender
• Aplicar políticas de proteção
• Monitorar ameaças
• Analisar alertas
• Implementar hardening de endpoints

Publico Alvo

• Administradores Windows
• Analistas de SOC
• Profissionais de Cybersecurity
• Profissionais de infraestrutura

Pre-Requisitos

• Conhecimentos de Windows
• Familiaridade com Active Directory
• Conhecimentos básicos de segurança de endpoints
• Noções de Group Policy
• Familiaridade com PowerShell é recomendada

Conteúdo Programatico

Module 1: Microsoft Defender Fundamentals

1. Microsoft Defender architecture
2. Endpoint protection concepts
3. Malware protection
4. Antivirus protection
5. Real-time protection
6. Threat detection
7. Threat prevention
8. Security intelligence
9. Defender components
10. Windows security architecture

Module 2: Antivirus Configuration

1. Real-time protection
2. Cloud-delivered protection
3. Automatic sample submission
4. Security intelligence updates
5. Scheduled scans
6. Quick and full scans
7. Custom scans
8. Exclusions
9. Tamper Protection
10. Antivirus policy management

Module 3: Attack Surface Reduction

1. Attack Surface Reduction concepts
2. ASR rules
3. Office application protection
4. Script-based attack prevention
5. Credential theft protection
6. Exploit mitigation
7. Application behavior restrictions
8. ASR auditing
9. ASR block mode
10. ASR policy management

Module 4: Defender and Active Directory

1. Group Policy integration
2. Centralized Defender configuration
3. Organizational Unit targeting
4. Security policy deployment
5. Domain-based endpoint management
6. Administrative permissions
7. Defender policy inheritance
8. Security baseline integration
9. Policy troubleshooting
10. Enterprise Defender management

Module 5: Threat Detection and Response

1. Malware detection
2. Suspicious process detection
3. Behavioral detection
4. Endpoint alerts
5. Threat investigation
6. Detection telemetry
7. Automated response concepts
8. Endpoint isolation
9. Threat remediation
10. Incident response workflows

Module 6: Monitoring and Logging

1. Defender event logs
2. Windows Event Logs
3. Detection telemetry
4. Security alerts
5. PowerShell monitoring
6. Process monitoring
7. Threat hunting
8. SIEM integration
9. Alert correlation
10. Security reporting

Module 7: Defender Hardening

1. Defender security baselines
2. Tamper Protection
3. Attack Surface Reduction
4. Credential protection
5. Cloud protection
6. Application control
7. Exploit protection
8. Endpoint security policies
9. Administrative protection
10. Defender hardening strategy

Module 8: Practical Defender Administration

1. Defender configuration assessment
2. Antivirus policy configuration
3. ASR policy implementation
4. Detection investigation
5. Event Log analysis
6. Alert analysis
7. Security baseline validation
8. Hardening assessment
9. Incident response exercise
10. Practical Microsoft Defender security cases