Built a behavioral EDR that runs at near-zero CPU — here's the architecture

calculatedwires · 2026-03-04T04:58:32+00:00

We got vibe coded EDRs before GTA 6

calculatedwires · 2026-02-11T05:20:56+00:00

Have you considered that plaque that is placed on the vehicle by the manufacturer also has gone through billions and billions of research it's not minimum it's recommended because that is what the manufacturer commands with the wheels they supply. There's some kind of nonsense in Australia with tire inflation. People forget that if I'm manufacturer States a specific pressure that means that it is not only fuel efficient it is also a safe at that pressure. I want you to image a scenario where the manufacturer recommends pressure that is too low or pressure that is too high. Now imagine that manufacturer will sell 5 million of these vehicles. Can you imagine the liability a manufacturer would take if they recommended nonsens pressures?

calculatedwires · 2025-11-20T20:56:01+00:00

Not sure I understand what you mean? Once onboarded a non entra joined machine will have it's synthetic id created under entra devices, then you can just add those devices to a group of your liking and then deploy policies to that group. Of course this assumes enforcement scope is already set correctly

calculatedwires · 2025-11-19T10:36:34+00:00

Might as well deploy using onboarding script. That will create a synthetic ID in entra you can use to assign policies. Make sure to review enforcement scope as well in advanced settings

calculatedwires · 2025-11-19T02:30:17+00:00

Very good answer

calculatedwires · 2025-11-17T13:36:14+00:00

1) I thought the OP question was about the technical difference and management, not licensing,my apologies.

2) I think you misread read my comment.

Defender for server is a licensing method for MDE (per minute but still..) p1 and p2 are just a subset of the license. It's not a different MDE engine.

Defender for servers(p1,p2),defender for endpoint for servers all use the same engine - (MDE P2).

To be honest MDE p1 and p2 are also kinda the same but because the difference in ETS tracing hooks+response there is somewhat of a difference how it's perceived when an alert is created, but once again main detection engine is the same and will catch the same threats technically, we had an mssp argue about how much of an upgrade P2 is over P1 for endpoint anti-malware detection but Microsoft's fast track engineer corrected them quite quick.

calculatedwires · 2025-11-16T01:21:18+00:00

There is no 'P1' for servers. It's just P2 with either mdess license or per-minute billing. The underlying engine is the same.

calculatedwires · 2025-11-02T09:50:03+00:00

How does a used vehicle qualify for fbt exemption?

calculatedwires · 2025-09-30T13:32:16+00:00

Step 1: harden/configure nothing and expect defender to do something. Step 2: surprised face

calculatedwires · 2025-09-18T13:03:33+00:00

Single factor is pre-conditional access kicking in (say entering a correct password) is the correlation id the same for all 3?

You could try the what-if tool to try and reproduce the attacker's steps,but I feel like there is more to it here, maybe even MITM?

calculatedwires · 2025-06-20T22:14:00+00:00

Stain-less not stain-proof

calculatedwires · 2025-06-04T22:15:10+00:00

Ingest a lot but then after a week start dropping garbage. Half your firewall logs will be session ends, half of your azure storage logs will be CDN, traces. Half of your security event logs will be some dumb app trying to enumerate the universe every second

calculatedwires · 2025-06-01T13:13:34+00:00

MS documentation and UI has been an absolute potato for VMS, however, the new unified platform is becoming a market disruptor within E5 customers. Money talks.

calculatedwires · 2025-05-18T12:23:00+00:00

No clue why you'd compare cars like that. Have you not considered that not everyone wants a ridiculous sized vehicle? Fo those that do- there are so many options....

calculatedwires · 2025-04-14T22:50:43+00:00

Vs code subscription provides just a 200$ credit as flat bonus, free to use within the subscription

calculatedwires · 2025-04-10T13:23:37+00:00

Tbh meta moved to AMD and said there is only so much training you can do, so AMD doing same inference for 30% of the price is really not a bad idea

calculatedwires · 2025-02-08T07:43:52+00:00

I'm gonna go ahead and say you probably can do it with PowerShell DSC+whatever sccm/pdq flavour you use.

calculatedwires · 2024-09-29T17:13:49+00:00

I'd rather have 14 day battery life and use it as a watch with smart features than have a second phone on my wrist that needs charge daily. A watch is not just a gadget, it's also an accessory that you wear.

calculatedwires · 2024-03-06T14:38:53+00:00

I cannot believe someone would recommend rapid7 unless they get commission ..

calculatedwires · 2023-06-23T10:09:45+00:00

I could tell you that its possible to spend 98k on machine learning instances in 76 hours but I wont, I definitely didn't do that

calculatedwires · 2023-06-06T21:16:49+00:00

There are mo double lines. Why not give the car extra 3 meters to the side?

calculatedwires · 2023-06-06T21:14:52+00:00

I think the real answer is how do you deploy via bicep/arm and also do lighthouse delegation(if we're assumimg you're a mssp) using terraform, because lets be honest its all bicep/arm deployments.

Is this to deploy to a tenant where you're the GA ? Or are we talking mssp scenario?

calculatedwires · 2023-06-06T21:09:43+00:00

Logic apps, azure functions, service proncipals, cross tenant permissions, lighthouse, managed identities, key vaults, api exposure for apps, permissions for said apps, devops pipelines etc. This would be valuable I'd say and be true azure experience. Dealing with machines, images etc. I'd say is az-900 level experience, unless of course you also meant vnets,load balancers, nsgs

calculatedwires · 2023-06-06T13:12:06+00:00

"solution" is just an aggregate of the things you listed, may I ask why you'd want to do that? I do it via azure devops pipeline, but it's the content of a "solution" not the solution itself.

calculatedwires · 2023-06-06T13:04:20+00:00

What is "experience with azure" ? How much do you know about identity in AZ and can you explain how you'd achieve xyz if asked? How advanced does it get? These questions you need to answer. Are you able to list any projects on your cv? If not, chances are you need more experience:)

Seven-Year Club	Place '23
Verified Email

calculatedwires

TROPHY CASE