Defend, Govern & Prove:
Managed detection

Hello everyone. Welcome back to episode six. This is manage detection. All part of the defend, govern series. So we're on that journey at the moment talking around products. How we as MSPs have been working with hundreds of products and I'll be transparent. Larger businesses probably are using about 100 products and trying to look at centralizing and unifying those into like a single Microsoft-based stack of solutions. So anti virus, office mailflow protection, sorry, outlook mailflow protection, exchange mailflow protection even, and also the XDR, so manage detection.

How do we start building us as MSPs into a new model from an old operating model to that modern MSP operating model? If you've been joining me on this series, this one I think really starts to turn the tide outside of our current foundations that we perhaps should already be offering and focusing on what can we offer moving forward. Taking that kind of new approach to not just compliance, governance, identity and endpoint, but really looking at detection.

So, how do we manage and deal with remediations, incidents, security events that take place? So let's start with why this episode exists. It's the universal challenge for us.

Every Microsoft 365 tenant generates security alerts daily. Absolutely does. Whether that's from signing log information where there's an incident that's raised on identity level to an endpoint issue and a management problem on around that. If we are looking to centralize our tools, there's a lot of information there on managed detection and there's a lot of alerts. It's a maturity gap for us. Very few organizations have genuine detection maturity in place. And this is something I really want to talk about and resonate with you guys a lot today or in this episode is really focusing on maturity when we talk about genuine detections.

And the reality for us is most managed service providers are drowning in signals, not just the insights. We get so much rubbish that goes into our PSAs, into our ticketing systems, alerting, it starts to drive fatigue. So let's talk about detection reality today and I'm only focused really in the Microsoft 365 environment. The reason why I want to focus solely in this area particularly on this sort of topic is what most Microsoft 365 environments actually look like across the enterprise deployment is exactly what you see here.

And I want to talk about this because this is where I think most if not all businesses and MSPs should be driving customers to because it forces us uplifting to business premium which gives us full control on identity. It gives us a whole stack of excellent incredible solutions and tools to manage our platforms our customers environments and it starts also with what's offered on detection. So this is defender for endpoint. It's enter ID protection, purview, data governance alerts, exchange online protection, defender for cloud apps, i.e.

Defender for office in that one, but defender for cloud apps for cloud app telemetry. The common pattern when we see this is the defender generating endpoint alerts, entry ID fl flagging identity risks, purview raising compliance issues if you're even on that journey with governance, data governance, a defender for office blocking threats and no single team in your organization who owns the full picture sees the entire picture that we're working towards. And this is where the central concern comes in.

It's chaotic alert streams. Everything's bundling in. How do we address it? How do we manage it properly? I think this is really where Microsoft introduced an XDR and in some respects auto remediations, the ability to remediate these events as they come in. I've done a webinar on this and if you already are interested in this, we do a bit of a deep dive into the security center into XDR. So look up that. It's in inforcer's platform.

If you're a current customer, you can absolutely rewatch that. But we do a bit of a deep dive into XDR and you can see exactly what's going on. How do we manage and manipulate alerts as they come in and what's automatically driven and solved and what's not. So this is where we talk about alerts and not the detection. And I think this is really important. The alert is the raw signal. It's the information that's coming in from that painoint, that area that needs to be resolved.

Detection is actually the interpretation, the correlation and the decision that turns those signals into an actionable intelligence service, a problem fix. Most environments and most MSPs for us, we actually stop at the alert. Whereas when we talk about manage detection, this kind of requires a human expertise, contextual understanding and consistent methodology. It's to separate genuine threats from noise. When we talk about detection, when we think about alerts, it's just fatigue. And it is in this instance, it becomes alert fatigue.

It's an agent overload. Hundreds of daily notifications from multiple security tools. It drives us mad and we get fatigued from it. We're not interested. We start missing some of the security gaps. And if it if you don't have that one body who has so much so many years of experience who actually can pick out every now and then the critical event that comes up, we're going to miss them. We will miss critical events because the noise is too high.

And then we end up dealing with trust erosion. So teams stop believing alerts represent real threats. So when we're building out these models and we want to try and offer like a security offering, whether that's ITR management, SOC service solutions, the thing that we really have to address is believing that the alerts that come in really are real threats. And that starts with reducing that agent overload. Those alert fatigues need to come down. And then the biggest problem when you take these two events, it becomes silent breaches.

Genuine threats as a result of these elements will slip through all of the noise and we've got no control. We won't be able to roll back. We won't be able to remediate and resolve these incidents. So let's look at the scaling problem here. For us, it's license variability.

Why detection breaks down across multiple tenants is because people are on different Microsoft. And for us as MSPs, it creates inconsistent security capabilities. Not one business is the same because we don't look at standardization. It also comes down to policy inconsistency. And this is where we drive home defend govern standardization baseline best practice. Each tenant has unique security policies, conditional access rules, and configuration standards. This is inconsistent. When we talk about building out the right model for the industries, vertical industries that we support as MSPs, we need to be consistent in our policy, standardize the best security measures and controls to produce the best outcome.

And that starts to drive the manage detection success rate, the ability to start not only driving good security practices, stopping the breach by plugging the gaps, but it starts us to offer a more of an efficient proactive service model that actually takes us from reactive and standardized trusted partner support management to this kind of proactive model, this new modern managed MSP operating model. So we start managing identity, we start managing endpoints, we start managing data and compliance and guess what we can now start managing detections and it builds on this.

So when we talk about the other areas here of our scaling problems is risk appetite differences. Client organizations have varying tolerance levels for security risks and operational disruption. That's something that every MSP I talk to struggles with. Every industry, every customer, every organization looks at risks differently. If we standardize a model, we're adop we're allowing them to adopt the same risk approach because we're focused on the main goal here, which is the highest levels of security to reduce the biggest amount of risk, but it's also making sure we have a measured operational disruption level.

So what manage detection actually means, there are four points to this. I think it's the same across any business that we talk about.

The first one's normalized signals, converting diverse alert formats into consistent, comparable threat indicators. We take all of that noise and we normalize it. We take that information and we put it into a central information that's understandable, readable, consistent baselines. This is probably the most important pillar of managed detection. If we are consistent establishing standard detection rules across all managed environments, we start to just standardize detection responses, remediations, alerting, remove that alert fatigue as an example, stop the trust erosion for our teams around what's coming in.

We start to deliver true accurate information that comes in. And as a result of this, we then can and we should be implementing clearer ownership, define the responsibilities for triage, investigation, and more importantly, escalation of decisions. And then the last point is actionable outcomes, delivering clear guidance on what matters and what action to take. These four areas are absolutely driven with SOC companies, MSSPs that focus on identity, ITR, sockbased resolution, security operational centers. These are the four controls and four pillars they look at whenever they take on a new customer.

They're going to focus on normalizing the signals, focusing on what really matters, the information that's relevant. You can build that in Microsoft Defender. Consistent baselines, making sure that the security controls they need for manage detection are in place. So, they're going to send you a list of things that control those elements. Emphasis on control. Control the elements. And then it's the ownership. They will take the owners of that of those events and they will devise it up appropriately.

Triage for them is an automated response AI looking at what the key areas the key alert triggers the fatigues coming the events that coming in and dribbling splitting them up for investigation and then it gets escalated when it's seen as a true critical event that is actually playing out as expected and that's where they then deal with actionable outcomes and quite often you'll find for an MSP we sit at the end of this the actionable outcomes we'll start with building out the consistent baseline based on their requirements ments and doing some tweaks to normalize signals.

But for socks, their main goal is clear ownership. They'll take that ownership when they talk about the model they offer and actionable outcomes. Sometimes they'll do deliver those themselves and they will be with automated responses, which is something we can also do as with Defender XDR. But some of those need to be escalated for us to handle. So, I'm not getting rid of SOC when we talk about big businesses. They're needed. It's a requirement. But for those smaller enterprise u SMBs that have got a smaller team, could we not maybe look at incorporating this if we're using Defender XDR automated responses, get rid of that fatigue?

I think we absolutely can. So let's look at the three pillars on this. Everything has a set of pillars when we talk about things. Identity being one, endpoints as well. The principle is the same here for detection. We have to detect. We have to see the response and we have to provide a remediation. And that's that course that we see right at the beginning of this journey starts with the signal.

The signal that's come in with the issue for detection. It's identifying and validating the issue. So does it really exist? And do we need to resolve it? If we do, then we need to start providing a response. And there's two points to this response. One's an automated task in Defender. The ability to kind of look at this and go, actually, it's anformational requirement. It's just a risk. We can take an action on that with remediation or actually no, this is critical.

So, we need to start making more decisions and this decision now needs to be made based on measures that we've configured with our MSP. So, we're going to get an alert. We're going to get receive an additional alert from this incident that's going to come and say, "Guys, we got a critical event. What do you want me to do?" That's what Defender's calling us to do. And then we go to remediations. And this is where we can execute the fix to resolve the threat.

And this whole journey you see can be handled automatically with defender. The ability to kind of look at informationational risks. An example of this is in the webinar I've done more recently. But also there are actions that we can do. So Microsoft always open up the door to isolate devices. So we can isolate them and then run code on the back end to remediate these situations. There's so much out in the community of pulling out information to remediate isolated and resolve isolated events.

Microsoft Defender offers a really good story when it comes to the event that's taken place or the incident that's occurred. It builds a picture of what's gone on. Starts with the date it started, where it's been targeted as the asset, the device, the user. It builds a picture that we can then leverage, support, and understand. And I think that is this is really invaluable. It's what SOC companies have been doing for years. And Microsoft have been able to bake this into the entire security center as a suite for incidents and investigations.

It's phenomenal what we can now do and see within one central console. So let's look at the signal fabric. The Microsoft signal fabric is incredibly useful when we talk about how things are built. We have a whole bunch of signals that Microsoft bring in. That's part of this XDR-based solution.

We have our identity signals, signs imp sign in patterns, risk detections, authentication events from entry ID. This is all injected into defender entry ID protection. It's an opportunity for us to see what's going on the identity level. We've got our endpoint signals, which is probably where most things stem from originally. Device behavior, threat detections, compliance status from Defender for Endpoint. All that information again injected into Defender XDR, email collaboration and collaboration, sorry, is exactly the same.

Phishing attempts, malware, suspicious attachments from Exchange and Teams, all those elements again fed through with Microsoft signal into Defender. And then lastly, cloud activity. So, Defender for Cloud apps areas where we can start measuring things. Don't get me wrong, most of this requires different levels of plan licenses, plan one, plan two, but we can build things out. Business premium with Defender Suite for Business adds some huge additional layers into the context. So we can get a lot more information at an SMB level.

Now something we've not had for a long time is now freely available for us to do. Obviously at a cost, not freely for us to implement and we can start measuring these. And guess what? All of this with the exception maybe at the moment of defender for cloud apps. It's configurable and standardized within inforcer. The ability to take these this information, build your defense, then layer your governance proving the value all starts and stems and can be stemmed from inforcer.

So, manage detection in Microsoft 365. Normally at this point, I'd consider doing a demo, but this is a YouTube video. I'm not demoing an inforcer specifically. If you want to do that, please reach out to us and we will go through a demo. We need to observe signal correlations and prioritize across identity, device, and user behavior. And this is where Microsoft's managed detection really excels in this area. Risky sign-ins being detected, cross signal correlation, prioritize responses.

This is where Microsoft's XDR solution is really driving a clear change in how we handle ITDR events, EDR events, MDR events, resolving incidents critically. Microsoft has got it all under security center and it's growing rapidly. Have one trillion signals a day that it manages. Can you imagine? That's three or four times more than most companies can offer. It's got so many signals coming in. It's going to adapt. It's going to be better. It's going to be stronger.

It's able to correlate this information and grow as it goes. So, what does this actually mean for our customers? Let me move myself out the way.

Or in fact, what do customers actually want? Customers don't want more alerts. They're actually after just clear answers to three essential questions. And I think it is just three. If it's more than that, I would welcome people's opinion. Are we at risk? Clear, visible, into current threat exposure. Are we at risk as a business? Most companies don't even think about this, but this is something we could be approaching our customers with. Are we? Really great question.

Does it even matter for my business? So, let's build the context on severity and business impact. Sometimes we can leverage the AI automations we have built in, but does it matter to my organization? Yes or no? The answer is most identity threats is going to be a yes. But it comes down to us as an MSP to drive that conversation. And the last point is what should we do? Actionable guidance on the next steps. All of those three areas are things we can report on.

Whether that's using inforcer, whether we're building these reports ourselves, they're answers there that we can already give to customers. And I think these three questions ring true. The ones that really care is the ones that say, "What should we do?" We almost every em every customer is going to say are we at risk and depending on how we respond depends on whether those next two questions come into play. If we say actually yes you are they're going to go okay well does it really matter in our environment then it comes down to a business impact.

Is it a yes or is it no? Again 90% of the time I think as MSPs we should be saying yes. And then the last point and this is where you see how mature that customer is or that industry organization is what should we do about it? What steps should we take? And for us as MSPs, we need to be proactive in that approach. We need to take it from them asking those three questions to say look we can see that you are going to be at risk because of this.

Yes, it does matter to your environment and actually we think you should be doing this. You've just turned those three questions into a proactive response for your customers. It's incredible how we can change and readapt these areas. So let's look at the MSP value shift that I want to adopt or I want MSPs to adopt. I want us to take the alerting and the monitoring responding to the individual notifications as they are. I want us to start that adoption.

I want us to start the risk ownership taking the responsibility for the client's overall security posture. I want to take it from inbox to driven outcomes. Triage whatever appears in the queue again to signal driven. We want to move this to driven behaviors. Actively hunt for patterns across correlated signals. And then finally from reactive to a proactive model. Take our old MSP operating model to a modern MSP operating model. And it starts with all of the defend governance proof series that we've done.

But managed detection is actually a quicker win than people think. Those three points on the left can 100% have 80% automation based on the right. With Microsoft Defender XDR, the automated response opportunities, the growing and the adapting, how it's building more signals, it's naturally going to drive us to be proactive. And that takes us back to those three questions the customer actually wants to ask that we're going to provide to them. Does it does are we at risk?

Really great question. Does it really matter to our organization? And what should I do about it? Those three those three questions resolved on the right hand side here with some automation in Defender XDR. Maybe we're going to start moving to that stronger detection and operating model. Not saying we're getting rid of ITDR platforms or SOC solutions, security companies because they're needed regardless. But we can start plugging those gaps. We can start handling this to a degree for our smaller customers, adding value, adding ongoing revenue, but also driving successful change.

So the last point I want to finish on here is Defend, Govern & Prove alignment detection capability, security signals and identify threats that identify threats sorry that's part of your defense. Your governance is riskbased prioritization that determines what matters most. And the last point is proving the value. Again evidence, audit trails, documentation, responses, actions that have been taken. This again fits those three pillars we've been talking about from the start. It's that opportunity to look at those new inter interactions and those new engagements.

What good looks like for me? Signals prioritized risk surfaced early and then fewer incidents. Could you imagine a world where we've integrated this up properly for all of our customers on a multi-tenant level and we can tick all three of these immediately and reduce the noise that we're getting. Get rid of that alert fatigue and more importantly we can handle it as an efficient service desk as an efficient MSP all of that's possible when we look at centralized consolidated service offerings so last point where most steps setups fail for me everything enabled all possible alerts turned on without any consideration for relevance or signal quality alert fatigue we don't do tuning and I think this is where socks excel default configuration ations never refined based on environments don't produce specific patterns.

So we don't see what's going on in the world and then for us there's a lack of ownership and then lastly no feedback loop. All of those four points in this entire series can be turned upside down. We can start to refine our alerts consider what's required what's relevant. ICDR intune based alerts we can start tuning it ourselves. Ownership. Let defender own those processes. Only alert us when an investigation is really needed. However, you deal with the responses.

And the last point is feedback. The more that we can see this the remediations, I want to get an integration from defender that's told me we had a critical event, but I remediate remediated it and this is the steps. So, when I produce that ticket report and send it to my customer, they're going to say, "Wow, you guys did a great job. You resolved this seamlessly. Thank you. Talk about turning the tide. Thanks everyone. Next one up is going to be AI specific.

So look forward to talking to you on this. Thank you.