DriveLock
Defender Management

Start your test now!

 
Category: Use Case 
Module: Defender Management
Testing Time: 30 min
This use case shows you how Microsoft Defender Antivirus works hand-in-hand with the DriveLock Zero Trust platform and its associated prevention tools.

1. What is the use case about?

With DriveLock Defender Antivirus, you can configure sttings related not only to malware protection, but also some advanced options for running programs. By integrating Microsoft Defender into DriveLock, you only need the DriveLock Management Console or the fully managed Security Service to configure the system. This makes it much easier to implement and coordinate with the more powerful security features of DriveLock Application Control. Combined with DriveLock interface control, unlocking external drives for users is linked to a detailed scan result: In case Microsoft Defender Antivirus detects malware, they will not be unblocked. Advanced automation is available when combined with DriveLock Endpoint Detection and Response (EDR). When Microsoft Defender Antivirus detects a threat, for example, the computer can be shut down using a script; or a DriveLock security campaign can be automatically initiated containing the next steps. 

 

2. How does it affect your client computer?

In this use case, DriveLock Microsoft Defender integration is enabled. The following scans are performed:
  • Email scan: scan email files and embedded objects (e.g. attachments)
  • Archive file scan: scan of e.g. ZIP or PAR files
  • Removable media scan: scanning of removable media even during a full scan

Additionally, attack surface reduction rules are employed, to prevent execution of potentially hidden scripts, theft of authentication details from the Windows Local Security Authority subsystem, Office applications in terms of executable content creation, or execution of untrusted or unsigned processes from USB.
 

3. How to monitor the results in the DOC?

The Microsoft Defender dashboard provides an overview of the security situation and possible threats in your company.

Defender
In addition, there is a separate view in the DOC, presenting status reports about current threats and the state of the clients.


DM-openthreats_NEW

Detected threats can be analyzed in more detail and, if required, notifications for false positives or irrelevant messages can be suppressed. 


Are you interested in the Defender Management reports, please click here or go back to our Managed Security Service Page.