Video Tutorial: Endpoint Protection Part 5 – Windows Defender Advanced Threat Protection Policies

by Contributed | May 24, 2021 | Technology

This article is contributed. See the original author and article here.

Hello everyone, here is part 5 of a series focusing on Endpoint Protection integration with Configuration Manager.  This series is recorded by Steve Rachui, a Microsoft principal premier field engineer.

This tutorial focuses on how Configuration Manager can be used to facilitate onboarding of a Windows device into Defender Advanced Threat Protection.  Steve also discusses what Defender Advanced Threat Protection is and how it is impactful for maintaining security in your enterprise.

Next in the series Steve focuses on how Configuration Manager integrates with Windows Defender Exploit Guard and can be used to deliver Exploit Guard settings. 

Posts in the series

• Introduction


• Antimalware policies


• BitLocker integration and management


• Firewall policies


• Windows Defender Advanced Threat Protection (ATP) policies (this post)


• Windows Defender Exploit Guard policies


• Windows Defender Application Guard policies


• Windows Defender Application Control (WDAC) policies

Go straight to the playlist

Walkthrough for AIP labelByCustomProperties Advanced Feature

by Contributed | May 24, 2021 | Technology

This article is contributed. See the original author and article here.

In the Information Protection world there are several technologies customers could choose to deploy. Ultimately, decisions will also be made to migrate away from them to other vendor products. When this happens, customers generally want to maintain a mapping from the older labels to newer labels, ensuring that they can easily apply new labels without the need for additional manual work.

This document will walk through how to leverage the labelByCustomProperties advanced feature for the cmdlet Set-Label included in the Security and Compliance PowerShell. This will enable us to create a mapping from one label to another, and is useful for use cases of moving from another labeling technology to Sensitivity labels, Secure Islands to Sensitivity labels, Sensitivity labels in Commercial tenants to Sensitivity labels in GCCH tenant, and much more.

Please keep in mind that the mapping is limited to labeling only, meaning that protection capabilities cannot be maintained during this mapping. There is also a potential for performance issues regarding its use with labeled emails.

1. Connect to the Security and Compliance Center (SCC) PowerShell. This enables you to leverage many of the advanced settings for sensitivity labeling. Ensure that the Module ExchangeOnlineManagement is installed. You can either use Windows PowerShell in admin mode and run the following command:

Install-Module -Name ExchangeOnlineManagement

Or https://www.powershellgallery.com/packages/ExchangeOnlineManagement/2.0.5 to manually download the module and then use it. After doing this, go ahead and import the module using the following command:

Import-Module ExchangeOnlineManagement

2. Connect to the PowerShell for your organization. You can specifically use this for organizations in Commercial M365 and M365 GCC:

Connect-IPPSSession -UserPrincipalName navin@contoso.com

Make sure to change the UPN that is tailored for your use case. For other endpoints such as GCCH organizations and more see here. 

3. Now you will be able to use the advanced settings by leveraging the SCC PowerShell. We will start by demonstrating one mapping of an AIP label in tenant A to an AIP label in tenant B. The example is demonstrated below:

Set-Label -Identity YOURTENANTBLABELNAME -AdvancedSettings @{labelByCustomProperties="description of rule,MSIP_Label_fc45349f-e0b8-4318-8dac-6a12a9c611fd_Enabled,true"}  

The advanced setting key is defined as labelByCustomProperties and the value is entered using the following format:

“Description of rule, Label Property, metadata”

To unpack the example some more, we start by using Set-Label as the command to set up the mapping of one label to another. To create more mappings, you create more instances of this Set-Label command.

For the -Identity parameter, you want to input what the resulting label name should be. I.e. if you were taking a document in Tenant A with “x” label and wanted it to display “y” label in Tenant B, you would want to input “y” for the -Identity parameter.

The -AdvancedSettings parameter has the key and value described earlier but let’s break down the value format further. For “Description of rule” you can input any string that would help you describe the mapping. For “Label Property” this would be the custom metadata property specific to our use case. In the example above we have an MSIP_Label that is indicative of the label from Tenant A which is “x”. Finally, we have the “metadata” and here we used “true” in the example to denote the scenario when this label metadata is present in Tenant B.

Thus, this label essentially allows us to go from one label in a tenant to another label in another tenant. There are other potential permutations of this, but we hope you understand how you can use this for your own use cases moving forward.

Learning Kusto Query Language – A tool for performance test engineers

by Contributed | May 24, 2021 | Technology

This article is contributed. See the original author and article here.

Video series by Bob Taylor, intro by Edwin Hernandez

Hello everyone! This time we bring you a series of video tutorials by Bob Taylor, who is a member of the Microsoft’s Performance & Quality Services Team. He recently completed this video series about Kusto Query Language, and this is a great opportunity for us to compile it into a single place for you along with some introductory information.

What is Kusto Query Language (KQL)?

You may be asking yourself: What is Kusto? What is KQL? And why would this matter for a Quality and Performance Test Blog? Well, Kusto itself was the internal code name for Azure Data Explorer, and Kusto Query Language (KQL) is the primary means of interaction with it. KQL allows you to send data queries, process data, and return the results of this processing without modifying the data or metadata. Now, why would this matter for Test Engineers? Let’s first define what Azure Data Explorer can do for you:

Azure Data Explorer

Azure Data Explorer is a service that allows you to store log and telemetry data. It can handle many data streams emitted by several entities concurrently (websites, LOB apps, CRMs, Social data sources, IoT devices, Cloud components, etc.). This data is collected and stored. Data Explorer then provides a way for you to analyze this large volume of data, perform complex queries and drill down into specific events.

Therefore, Azure Data Explorer provides a great way for you to perform diagnostics, monitoring, and reporting of all components of your application and environment. This kind of analysis is key for performance testing and application optimization.

Kusto Query Language(KQL)

KQL is a read-only query language. The syntax is similar to SQL, but it was created specifically to work with large datasets in Azure. Since it’s read-only there are no update or delete clauses. It is based on relational management systems, which use schema entities, and is organized into a hierarchy like SQL’s databases tables and columns.

Other Azure Services

KQL is the primary mean to query data from Azure Data Explorer; however, it is also used to interact with the following inter-related Azure services:

• Application Insights


• Log Analytics


• Azure Monitor, and again:


• Azure Data Explorer

Microsoft documentation

If you want to learn more from the official Microsoft documentation, make sure to check out the following:

• What is Azure Data Explorer? Check this one to learn about the possible data sources and workflows.


• What are Application Insights? Fundamentals, how to implement the telemetry, do analysis, etc. We hope to bring you a detailed guide on this blog in the future.


• Azure Monitor Overview. Solution for collecting, analyzing, and acting on telemetry from your cloud and on-premises environments.


• Overview of Log Analytics.  Tool in the Azure portal used to edit and run log queries with data in Azure Monitor Logs.


• Getting started with Kusto. Check this one to learn the basics about KQL, where there is a tutorial and samples.


• For a more hands-on kind of learning, check out this lab in Microsoft Learn: Monitor performance of virtual machines using Azure Monitor for VMs

Bob Taylor’s Video Series

If you are done leafing through the official documentation above and want a much more detailed training. Bob created a series of video tutorials where he goes into detail on KQL, from the fundamentals to complex functions, passing through the most common operators:

In Conclusion…

If you want to monitor and diagnose the performance of your application in Azure, KQL is a key resource. It is a good skill to have in your portfolio, especially if you are involved in load testing. Please make sure to check our other article about a Collection of Useful Tool for Performance Test Engineers, and please leave any questions in the comments section.

Thanks!

Is security a blocker for IoT? Let's discuss!

by Contributed | May 24, 2021 | Technology

This article is contributed. See the original author and article here.

The Azure Sphere Team is doing Microsoft Build 2021 a little differently this year: we want to talk about blockers to success. We understand that security can sometimes be a blocker: either the lack of security prohibits connectivity and stymies opportunity; or stringent security limits innovation and reduces functionality. Either way, you might not be getting the value you want out of IoT technologies. Let’s talk about those needs and let’s go deep:

Join our customer roundtables for deep discussions with our IoT and security experts and let’s really examine the barriers to success for your industry, your line of business, and your role. Together we can identify the investments at the engineering level across IoT hardware, software, services, and security that will unlock productivity and opportunity for you and your industry.

• We’ll talk about the developer experience and how we can improve the processes and time it takes to build secured IoT solutions from edge to cloud.


• We’ll talk about how building the next generation of IoT devices and experiences strains the security available now and what customers have taught us needs to change.

Build is open to everyone, and you can still register here: Microsoft Build 2021

Add your voice, insight, and expertise to Build 2021. Come find us:

• Build 2021 – Build Secured IoT Solutions for Azure Sphere with IoT Hub


• Build 2021 – Securing IoT devices and lowering your costs


• Build 2021 – IoT semiconductor ecosystem: building and connecting secured devices

You’ll want to RSVP for the roundtables right away—seats are limited—it’s the best way for you to make direct connections with product team members.

There is IoT content for everyone at Build: check out our lineup!  We look forward to seeing you tomorrow and throughout the week!